France Attributes October Refrigeration Cyberattacks to Iranian Group Shahid Kaveh After 700 Retail Sites Impacted

On November 9, the French government officially attributed cyberattacks conducted on the night of October 11–12 against domestic retailers to the Iranian Revolutionary Guard-linked group Shahid Kaveh. French authorities stated this was the country's first purely destructive cyberattack, estimating food losses at tens of millions of euros. According to an analysis by France's Interministerial Cyber Crisis Coordination Center (C4), attackers targeted refrigeration controllers across more than 700 retail sites by raising defrost temperature settings. This led to extensive food spoilage and sparked at least 15 fires. The campaign also affected small hydroelectric power facilities in France, causing moderate disruption to their Schneider Electric industrial equipment. C4's technical analysis revealed that network infrastructure used in the attacks had also been deployed to reconnoiter Schneider Electric systems, bearing traces of Persian language usage and FOFA network asset scanning tools. C4 noted the group previously claimed attacks against industrial control systems in Israel and the United States.

Key takeaways

• France attributed mid-October destructive cyberattacks to Iranian group Shahid Kaveh, marking its first purely destructive cyber campaign.
• Attackers altered defrost temperature settings across more than 700 retail refrigeration units, sparking at least 15 fires and causing tens of millions of euros in food damage.
• Schneider Electric industrial equipment at small hydroelectric facilities was also targeted, experiencing moderate disruption.
• The coordination center C4 based attribution on shared infrastructure, reconnaissance logs, FOFA usage, and Persian language artifacts.