France Links Supermarket Refrigeration Attacks to Iran

France has attributed a wave of cyber-attacks on refrigeration control systems at around 700 supermarkets in France to Iranian hacking groups, according to French authorities. Paris Public Prosecutor Laure Beccuau said investigations have found links between the October 11–12 incident and IRGC-linked groups Shahid Kaveh and Shahid Shoostari.

CERT-FR’s technical attribution notice ties Shahid Kaveh to various hacktivist-affiliate personas, and investigators from OFAC and DGSI identified Iran-based endpoints and traces containing Farsi language. The attackers’ techniques, TTPs and the overall profile of the operation align with prior Shahid Kaveh campaigns, and CERT-FR named three leaders of the IRGC and Shahid Kaveh as connected to the cyber-attacks. A judicial investigation has been opened into the cyber-attacks and the damage caused.

France says it will pursue punitive measures, including summoning Iran’s ambassador to formally condemn the attacks and urging European partners to broaden sanctions against Iranian individuals and entities implicated in this and other cyber activities. The government also reserved the right to take further public or undisclosed measures as deemed necessary and proportionate.

The attribution is described as an unprecedented campaign in scale and aggressiveness, with authorities stressing that this represents sabotage on French soil. Gary Barlet of Illumio welcomed the move toward European sanctions, noting it would be interesting to see their form and urging that consequences be more consistently applied to deter future assaults.

The CERT-FR notice places this campaign within a broader line of IRGC-linked cyber incidents dating back to 2020, though it does not relate to the November incident affecting the French Blood Service.