Shahid Kaveh: 700 French stores and 15 fires

France on Monday named an Iranian military cyber unit for the October attacks that knocked out refrigeration at about 700 shops and other food businesses and started fires. The foreign ministry blamed Shahid Kaveh, a unit inside the electronic and cyber center of the Islamic Revolutionary Guard Corps. The attacks ran overnight on October 11 and 12, 2026. Cold rooms were driven out of safe range. Authorities put the spoiled food in the tens of millions of euros, with serious damage to equipment, and they say at least 15 fires started. The Paris prosecutor’s office has put the number of fire starts at about twenty.

Foreign Minister Jean-Noël Barrot confirmed the finding to reporters at a G7 meeting in Paris and called the sabotage unprecedented in scale and aggressiveness. France has summoned Iran’s ambassador and says it will seek European sanctions. The write-up is a report from the Cyber Crisis Coordination Centre, C4, issued as CERT-FR note CERTFR-2026-CTI-009. C4 brings together ANSSI, military cyber command, and the intelligence services.

Who lost the cold

Early public counts put the October damage at roughly 250 to 350 French supermarkets. The state’s figure is now about 700 retail locations. The CERT-FR account reported Monday names Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, plus smaller butcher shops, a slaughterhouse, and cooperative food plants. The cold rooms in the case used Danfoss and Dixell controllers. Reported peaks reached about 50°C.

The same window includes Schneider Electric equipment at several small hydroelectric plants. Investigators tie that activity to the same campaign and describe the disruption there as moderate.

The Paris prosecutor, Laure Beccuau, opened a judicial investigation the same day. The case covers organized intrusion and damage to computer systems, with the aggravating claim that the acts served a foreign power. Her office has asked for international arrest warrants for the head of Shahid Kaveh, two deputies, and other suspects still unnamed. The file sits with the anti-cybercrime office OFAC and the domestic intelligence service DGSI. An annex to the C4 report names Hamid Reza Lashgarian as head of the IRGC electronic and cyber center, and Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh.

Washington has previously described Shahid Kaveh as the operators it calls CyberAv3ngers, linked to disruptions at U.S. water utilities, and the State Department has offered rewards up to $10 million on that line of cases. The French report also discusses a second IRGC unit, Shahid Shoostari, in connection with older activity against French media and Olympic-period display screens. The refrigeration attacks are attributed to Shahid Kaveh.

Iran had not published an official reply by Monday evening.

What this attribution leaves open

C4’s finding covers the October 11–12 attacks on French refrigeration. The report leaves the November cold-chain incidents in other European countries, and the November 2 disturbance at France’s national blood service, outside that finding. A grocer outside France should keep its own timeline, its own logs, and its own conversation with the vendor.

What to change on a cold room

List every chamber whose temperature or defrost schedule can be changed by someone who is not in the building. Include Danfoss and Dixell controllers, vendor monitoring portals, and rented plants. Put that path on a network of its own, off the store LAN and off guest Wi-Fi. Vendor maintenance can come through a brokered session. A controller that will take a new setpoint from the open internet is part of the safety system, whoever pays the invoice.

Alarm on the temperature with a probe and a pager that stand apart from the controller’s own alerts. The October fires are the reason. A room that is supposed to stay frozen can become a heat source, and the crew that has to dump stock needs the page while the food is still movable. Log every setpoint change with a user and a time, and read the night of October 11–12 the way you read a production incident. Sites that run Schneider Electric gear on small hydro should review that same night. France called the effect moderate. Moderate still belongs in the log.

Install the current vendor builds for the controller families you actually run. This briefing stops at the public toll and the name on the attribution. The control that matches Monday’s count is a cold room that still alarms when the remote path is wrong.

This briefing relies on public reporting by BleepingComputer and on France’s CERT-FR report CERTFR-2026-CTI-009. It does not include exploit procedures.