Iran's Revolutionary Guards behind refrigeration system sabotage in France – Austria also threatened
Hackers from Iran's Revolutionary Guards manipulated cooling systems in 700 French supermarkets; damages estimated at tens of millions of euros. Austria has reported no comparable incidents so far, but does not rule out attacks.
Iran's Revolutionary Guards behind unprecedented infrastructure sabotage in France
As diepresse.com reports, the cyberattack on France's cooling infrastructure was significantly more extensive than initially assumed. The French government describes the operation as "the first cyber campaign on French soil aimed exclusively at sabotage" – and classifies the level of aggressiveness as "unprecedented".
Hackers manipulated the control systems of cooling equipment in approximately 700 supermarkets and deliberately heated the systems up. Damage was estimated at several tens of millions of euros. France's joint crisis centre reports that fires broke out in 15 cases. Smaller butcher shops, an abattoir, and several food processing facilities were also affected. Control systems at smaller hydroelectric power stations were also targeted, although the effects there remained "limited".
Trail leads to Shahed Kaveh
France's crisis centre names the hacker unit Shahed Kaveh as the perpetrator of the attack – a unit that falls under Iran's Revolutionary Guards. The group operates under varying names: CyberAveng3rs, Soldiers of Solomon, Mr. Soul, or Cyber Isnaad Front. It became known in 2023 through attacks on Israeli control systems manufacturer Unitronics. At that time, at least 34 control devices at water and wastewater facilities in the USA were compromised, including the municipal water supply of Aliquippa in Pennsylvania. In spring 2026, the group claimed further sabotage operations against Israeli and American industrial facilities.
According to French findings, Shahed Kaveh has possessed tools since at least June 2024 with which it can specifically locate and manipulate control systems from manufacturers Schneider Electric, Siemens, and Rockwell.
Evidence and diplomatic response
The crisis centre presented a series of evidence: the attackers used techniques already known from Iranian hackers. The search tool FOFA was used in previous operations by the group. Traces of the Persian language were also found in the attack infrastructure. Just one day after the attack, CyberbanNews, a propaganda portal attributed to the Revolutionary Guards, reported on the attack.
Foreign Minister Jean-Noël Barrot had Iran's ambassador summoned to the ministry on Tuesday. Barrot announced he would push for EU sanctions and did not rule out a cyber counter-strike. France's cyber doctrine offered a variety of options – including those "one does not speak about publicly". Barrot was alluding to the offensive cyber strategy, which also includes the targeted disruption of adversary computer systems. Technically, France still lags behind the USA and Britain, but is expanding its capabilities.
Further attacks in Europe and the USA
Less than three weeks after the incidents in France, numerous cooling systems in Europe were attacked again – including in Belgium, Sweden, and Luxembourg. Attacks on cooling systems at US military bases fit the same pattern. Since the beginning of the Iran conflict, there have also been cyberattacks on Los Angeles's public transport system with a trail leading to Tehran. Whether Iran is behind the entire European attack wave remains unclear for now.
For France, crisis centre C4 has also documented a backstory: another unit of the Revolutionary Guards, Shahid Shoostari, is said to have hacked the online shop of Charlie Hebdo in 2023 and attempted during the 2024 Olympic Games to hijack French display boards for anti-Israel messages.
Austria: No comparable incidents so far – but no free pass
According to the Constitutional Protection Report, Austria is also in the sights of the Iranian regime. Domestic business and the dissident scene are being spied upon, according to the report. The Interior Ministry told the "Presse" that no comparable incidents such as those in France have been reported so far. Initial investigations also revealed no concrete, comprehensive threat from comparable equipment in Austria.
Nevertheless, the authorities emphasise: "In principle, such attacks cannot be ruled out in Austria either." The ministry names unsecured remote access connections and the operation of end-of-life devices that no longer receive security updates as particular risk factors.
Source: Kleine Zeitung