French prosecutors have pinned a wave of cyberattacks targeting refrigeration equipment at roughly 700 commercial locations on a hacking unit tied to Iran’s Revolutionary Guards. The intrusions, which struck supermarkets, food processors, and other businesses on October 11 and 12, caused widespread spoilage and sparked at least 15 fires.
Paris summoned Iran’s ambassador on Monday as Foreign Minister Jean-Noel Barrot signaled the European Union could impose fresh sanctions on Tehran. A joint probe by French intelligence and cybersecurity agencies identified Shahid Kaveh, an offensive cyber outfit within the Revolutionary Guards, as the group behind the sabotage. Investigators also named three alleged operatives: Hamid Reza Lashgarian, Mahdi Lashgarian, and Reza Salarvand.
The hackers reportedly masked their activities behind front groups posing as independent hacktivists, including CyberAveng3rs and Cyber Isnaad Front. Digital forensics linked the operation to Shahid Kaveh through reused infrastructure, patterns matching earlier Iranian campaigns, and Farsi language traces embedded in the attack code. Paris prosecutors have requested international arrest warrants for the suspects.
The aftermath proved costly. Workers discarded spoiled meat, melted frozen goods, and other ruined perishables after refrigeration units were manipulated to overheat, triggering fires in some cases. One supermarket owner pegged the national financial toll in the tens of millions of euros. Smaller butcher shops, a slaughterhouse, and food factories also sustained disruptions.
A follow-up campaign in November hit more than 100 facilities across Europe, including cold storage used by French blood banks. Staff scrambled to relocate blood supplies to alternative refrigeration. Tehran’s UN mission offered no comment, though Iranian officials have repeatedly denied conducting malicious cyber operations.
Meanwhile, Microsoft had quietly tied the October incidents to Iran at least two weeks before France’s public announcement, according to three people familiar with the assessment. The company declined to comment. Investigators are also probing possible connections to August failures of refrigerators at several US military commissaries, which prompted a Pentagon inquiry into suspected cyber sabotage. American officials consider Iran a possible suspect in that case, though no conclusion has been reached.
Outdated refrigeration hardware may have made the French attacks easier to pull off. The manufacturer of several affected systems acknowledged some units ran obsolete firmware, leaving them exposed to unauthorized access. The incidents now sit within a broader pattern of suspected Iranian cyber operations targeting the Los Angeles transit system, American water utilities, and commercial shipping.
