In the autumn of 2026, a quiet machinery that keeps European groceries cold was turned against itself. Across more than seven hundred French stores, the controllers that hold milk and meat at safe temperatures were tampered with, and what followed was spoiled food, fires, and losses measured in tens of millions of euros. Paris has now named a shadowy unit of Iran's Revolutionary Guard as the hand behind it, a reminder that the infrastructure of ordinary life has become a field where states contest one another without firing a shot. The attribution is a sober act of accounting, and what it will
France Blames Iran's IRGC-Linked CyberAv3ngers for Cyberattacks That Spoiled Food at 700+ Supermarkets
Destructive attacks sparked at least 15 fires and spoiled food at more than 700 French grocery stores, with similar food losses reported in Belgium, Ireland, Luxembourg and Sweden.
The first cyber offensive carried out purely for sabotage on French soil
Mark
Why does this one stand out from other cyberattacks?
Mimi
Because the goal was destruction, not theft. Over 700 stores lost food, and at least 15 fires started. France calls it the first purely sabotage campaign on its territory.
Luke
Worth noting that "first" and "unprecedented" are the French government's characterizations. The fire and loss figures come from the C4 report.
Mark
How does France tie it to Iran?
Mimi
Shared infrastructure with reconnaissance on Schneider Electric equipment, techniques linked to Shahid Kaveh since April 2026, Farsi traces, and fast publicity from CyberbanNews.
Luke
Those are indicators, not a smoking gun. Farsi traces and quick publicity could in principle be planted, and the report's evidence is described, not published here. The attribution is France's own.
Mark
What about the water attacks in the US?
Mimi
The crew is suspected there too, but Washington hasn't named anyone for the July intrusions. Private analysts blamed Iran.
Luke
Right, so that link is suspicion from private firms, not an official finding. The 2023 attribution is the firmer one.
Mark
And what happens now?
Mimi
Proposed EU sanctions, a protest to the Iranian ambassador, and an open door to other measures, some of which may stay non-public.
Luke
Unknown is what those measures are, and whether the European incidents in November are confirmed as the same actor. The reporting says only that they were similar.
O Pulso
- Seven hundred grocery stores lost control of their refrigeration in a single October night, and fires broke out in at least fifteen of them.
- Paris has pinned the attacks on the Iranian Revolutionary Guard's CyberAv3ngers unit, turning a technical incident into a diplomatic confrontation.
- France is pushing for new EU sanctions and a formal protest to Iran's ambassador, while holding back further measures it may yet take.
- Similar food losses in Belgium, Ireland, Luxembourg and Sweden suggest the disruption is spreading, and officials elsewhere are watching closely.
In the autumn of 2026, a quiet machinery that keeps European groceries cold was turned against itself. Across more than seven hundred French stores, the controllers that hold milk and meat at safe temperatures were tampered with, and what followed was spoiled food, fires, and losses measured in tens of millions of euros. Paris has now named a shadowy unit of Iran's Revolutionary Guard as the hand behind it, a reminder that the infrastructure of ordinary life has become a field where states contest one another without firing a shot. The attribution is a sober act of accounting, and what it will cost, and who will answer for it, remains open.
On the night of October 11 into October 12, the refrigeration controllers at more than 700 French grocery stores were attacked. Food spoiled, at least fifteen fires broke out, and France's Cyber Crisis Coordination Centre estimates the losses in the tens of millions of euros. Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché were all among the chains affected.
In its report, the C4 named the Shahid Kaveh unit of Iran's Islamic Revolutionary Guard Corps, known to the world as CyberAv3ngers, as the responsible party. The case rests on shared infrastructure, techniques tied to the group since April 2026, traces of Farsi in the attack tools, and a reportedly linked Iranian outlet that publicized the incidents within two days. The same unit is suspected of earlier intrusions into industrial equipment and into American water systems.
France calls the campaign unprecedented in scale, the first purely sabotage-driven offensive cyber operation on its soil. Paris intends to propose additional EU sanctions and to deliver its strongest condemnation to Iran's ambassador, while keeping other measures in reserve.
The damage has not stopped at the French border. Stores in Belgium, Ireland, Luxembourg and Sweden have reported similar losses, and the United States has urged operators to harden their systems. What comes next will depend on the sanctions proposal and on whatever France has chosen not to say aloud.
On the night of October 11 into October 12, refrigeration controllers at more than 700 French grocery stores were attacked. The result was spoiled food, at least 15 fires, and losses that France's Cyber Crisis Coordination Centre, known as the C4, puts in the tens of millions of euros. The chains affected were Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché.
On Monday, the C4 published its report, and Paris named who it holds responsible: the Shahid Kaveh unit of Iran's Islamic Revolutionary Guard Corps, better known by hacktivist personas including CyberAv3ngers. French national security officials say the unit is led by Reza Salarvand and Mahdi Lashgarian. The C4 brings together the National Cybersecurity Agency, the external and internal security directorates (DGSE and DGSI), the Directorate General for Armament, and the Cyber Defence Command.
The Ministry for Europe and Foreign Affairs called the campaign unprecedented in scale and aggressiveness. It described it as the first offensive cyber campaign carried out purely for sabotage on French national territory.
The report lays out several reasons for the attribution. The infrastructure used in the October supermarket attacks was also used in the same period for reconnaissance against Schneider Electric equipment, focused on small and medium-sized energy and water production units. The report says the techniques involved have been tied to Shahid Kaveh since at least April 2026. Investigators also found traces of Farsi use in the attack infrastructure. And an Iranian outlet, CyberbanNews, reportedly linked to the unit, publicized the incidents as early as October 13.
The French government says the unit has been able, since at least June 2024, to scan, access, and control industrial equipment from Schneider Electric, Siemens, and Rockwell. The same crew is suspected in July attacks on more than 100 internet-exposed water systems in the United States. Washington has not attributed those intrusions to any country or group, though private-sector analysts blamed Iran and CyberAv3ngers specifically. In 2023, US national security and law enforcement agencies did attribute a series of attacks on multiple American water facilities to the group.
The French ministry framed the episode as part of a pattern: Iran, it said, has already carried out destabilizing acts against France, including targeting the magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.
The problem has not stayed within France. In early November, similar attacks on commercial refrigerators and freezers were reported across Europe. Grocery stores in Belgium, Ireland, Luxembourg, and Sweden reported widespread food losses after temperatures were pushed as high as 50°C (122°F). Last week the US federal government urged owners and operators to take security measures to keep such attacks from reaching America.
France says it will use all available means of response, including within the European Union and with international partners. Concretely, it will propose additional EU sanctions against Iranian entities and individuals involved, and it will deliver its strongest condemnation to the Iranian ambassador. It also reserved the right to take further measures, public and non-public, that it judges necessary and proportionate. The sanctions proposal and whatever remains unstated are what to watch next.
Citações Notáveis
France will use all available means of response, including within the EU, to deter and respond to destructive actions in cyberspace.— French Ministry for Europe and Foreign Affairs
The Iranian cyber threat against French interests is not new.— French Ministry for Europe and Foreign Affairs
Quer a matéria completa?
Leia o original em EUROPE SAYS ↗
Politics & Governance