France Blames Iran's IRGC for Sabotage of Refrigeration Controllers at About 700 Retail Sites

The attackers broke into the controllers on the night of 11 October and changed their defrost settings to high temperatures, causing food losses and, in at least 15 cases, fires, according to the French government. The Paris prosecutor's office opened a judicial investigation against the unit's head, the head's two deputies and anyone else identified, and has requested international arrest warrants.

The unit is called Shahid Kaveh and is known mainly through hacktivist personas such as CyberAveng3rs and Cyber Isnaad Front. The French C4 coordination center, which brings together ANSSI, the DGSE, the DGSI, the armament directorate and the cyber defense command, said four indicators point to the IRGC as sponsor and Shahid Kaveh as the unit that carried out the attack. France's Foreign Ministry plans to summon Iran's ambassador and to ask European partners to adopt new sanctions.

Why it matters The case shows a state-linked unit using remote web interfaces of operational technology to cause physical damage and fires, not only data loss. Operators of refrigeration and other connected industrial controllers should treat any internet-exposed management interface as a direct sabotage path. The CERT-FR alert recommends removing internet exposure, restricting access to a secure VPN or protected network, and reviewing defrost configurations, and it warns that end-of-life devices without security fixes are very likely to be compromised again if left exposed.