Cyberattack on refrigerators: France accuses Iran
Iran was behind the cyberattack against around 700 French supermarkets in October, the judiciary announced on Monday. The Paris prosecutor's office has opened an investigation against the cyber unit of the Revolutionary Guards.
Iran identified as perpetrator of attack on French refrigerators
According to Le Nouvel Obs, Paris prosecutor Laure Beccuau announced on Monday 9 November that Iran was behind the cyberattack targeting refrigerators of the brands DANFOSS and DIXELL in around 700 French supermarkets. The attack, carried out during the night of 11 to 12 October, disabled the defrost systems of the devices, causing temperatures to rise to 50 °C, resulting in significant food losses and around twenty fires.
The Paris prosecutor's office opened a judicial investigation against "the leader of the Iranian Shahid Kaveh group, an offensive cyber unit affiliated with the Electronic and Cyber Centre of the Revolutionary Guards Corps (CGRI-CEC)", as well as "his two deputies and against any other person who may be identified". International arrest warrants were requested as part of this investigation.
French investigators identified "an operational method characteristic of this unit", notably through "the use of Farsi and IP addresses pointing to terminals located in Iran". This cyberattack is added to other operations attributed to Iran: an attempt at "destabilisation" against Charlie Hebdo in 2023 and an operation against a French video display company in 2024 during the Olympic and Paralympic Games.
The attack was initially claimed by pro-Russian hacker groups, Noname057 and Z-Pentest Alliance, on 5 November. However, the Kremlin denied being behind the operation. This claim moreover had not been supported by photographic or video evidence, unlike the usual practices of these groups.
The Shahid Kaveh group, also known as "CyberAv3ngers", targets according to the authorities "operational technology equipment in the Middle East" and conducts "destabilisation attacks against industrial control systems". These hackers claimed cyberattacks against Israeli companies in October 2023. A Federal Bureau of Investigation report published in April 2026 classifies this group as an "advanced persistent threat". The FBI indicates that the "CyberAv3ngers" use "malicious file alteration" and "data manipulation" against their targets.
In spring 2026, the FBI pointed out that "campaigns conducted by these groups" had increased, "probably in response to hostilities between Iran and the United States and Israel". According to American services, this group is also referred to by the names: Hydro Kitten, Storm-0784, Bauxite, Mr. Soul, or Soldiers of Solomon.
Foreign Affairs Minister Jean-Noël Barrot announced at a press briefing on the sidelines of the G7 that he was "in a position to confirm the responsibility" of Iran's Revolutionary Guards. He denounced an attack of "unprecedented" scale and "aggressiveness". Iran's ambassador to France was summoned "to lodge a strong protest against this extremely serious act".
Barrot promised "sanctions at European level against all those responsible for this attack". In total, twelve European countries were victims of cyberattacks on refrigeration systems. Nine countries were hit simultaneously on 2 November: Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden, as well as three sites of the French Blood Establishment.
Kaja Kallas, head of European diplomacy, informed G7 member countries that Iran was behind the cyberattack in France. "We have the Foreign Affairs Council next Monday, so we will have the opportunity to discuss it, because these cyber incidents occurring in Europe, if they are attributed, also call for a strong response from us", she said.
Source: Le Nouvel Obs