France blames Iran for fridge cyberattacks, says some caused fires

French authorities on Monday accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of a cyberattack sabotaging refrigeration systems at around 700 French grocery stores last month, causing what it said were extensive food losses and at least 15 fires.

The accusation was made in a five-page report published Monday by France’s Cyber Crisis Coordination Centre, which brings together the national cybersecurity agency ANSSI, the military’s cyber command and the DGSE and DGSI intelligence services.

In the first attribution since the October attacks, the French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at U.S. water utilities.

France’s Foreign Minister Jean-Noël Barrot told reporters at a G7 ministerial meeting in Paris that he could confirm the IRGC was responsible for the fridge attacks, describing the sabotage as unprecedented in its scale and aggressiveness.

France has summoned Iran’s ambassador and Barrot said the country will pursue European sanctions against those responsible.

Victims of the first wave of attacks included stores operated by large chains, as well as smaller businesses including butchers, a slaughterhouse and cooperative food-processing plants.

ANSSI said it also identified the Iranian hackers simultaneously targeting Schneider Electric equipment at several small hydroelectric facilities, although the disruption to those systems was described as moderate.

The cybersecurity agency’s report does not address the second such wave of attacks against refrigeration systems in early November. That wave hit businesses in at least 11 European countries, including British meat suppliers and three sites operated by France's national blood service.

The Paris Prosecutor’s Office said at the same time Monday it was opening a judicial investigation against the head of the Shahid Kaveh unit, as well as two of its deputies and other suspects yet to be identified. It has requested international arrest warrants for the suspects, according to prosecutor Laure Beccuau.

Outing the cyber saboteurs

French investigators identified a range of evidence linking the attacks to Shahid Kaveh including Farsi text artefacts, tooling and infrastructure used in reconnaissance on other industrial equipment.

An annex to the report names and pictures Hamid Reza Lashgarian, head of the IRGC Electronic and Cyber Center, and Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh.

Earlier this year, the U.S. Defense Department, FBI, National Security Agency and other federal agencies identified Shahid Kaveh as another name for the CyberAv3ngers group, which it linked to attacks targeting operational technology (OT) devices and causing disruptions across multiple U.S. critical infrastructure sectors.

The U.S. State Department had previously offered rewards of up to $10 million for information on six IRGC officials connected to the group’s 2023 attacks on U.S. water utilities. It names both of the Lashgarians. Salarvand had not previously been publicly identified.

In September, the State Department announced a further reward for information on Amir Yaryab, whom it accused of overseeing CyberAv3ngers operations.

The ANSSI report separately attributed several earlier attacks against French interests to another IRGC unit, Shahid Shoostari, also known as Emennet Pasargad, including the defacement of the website of satirical newspaper Charlie Hebdo.

The unit also attempted to hijack digital advertising displays during the 2024 Paris Olympics, compromising a French company managing video display terminals and attempting to use them to show images condemning Israeli athletes’ participation in the Games.

The intrusion was discovered before the images could be displayed. Investigators traced related material to a Persian-language Instagram account, two X accounts and an Iranian news website. They also identified connections from two Iranian internet service provider IP addresses.

French authorities linked Shahid Shoostari to an earlier plan to target Charlie Hebdo in 2020, following the newspaper's republication of cartoons depicting the Prophet Muhammad.

ANSSI said both Shahid Shoostari and Shahid Kaveh operate under the IRGC’s Electronic and Cyber Center. The agency described the incidents as part of a campaign of destabilization against French interests dating back at least six years.

Iran routinely denies conducting malicious cyber operations. It had not publicly responded to France’s allegations by Monday evening.