Chilling Sabotage: Freezers Hijacked Nationwide

Grocery store meat aisle stocked with packaged beef and poultry — Photo: Jacquie Klose / Shutterstock

France says an Iranian military cyber unit hijacked supermarket freezers, spoiled food, and sparked fires across the country.

Story Highlights

France formally blamed an Iranian Revolutionary Guard cyber unit for attacks on over 700 retail sites.
Investigators say hackers forced “indefinite defrost” cycles and silenced alarms, causing spoilage and fires.
Paris prosecutors opened a case and sought international warrants for three named suspects.
Iran denied the charge, while France weighed responses and sanctions.

French Government Attributes Attacks To Iranian Military Cyber Unit

French officials issued a rare, formal attribution naming Iran and a specific military-linked unit as the source of a sweeping cyberattack on retail refrigeration systems. France’s foreign ministry said the offensive was carried out by Shahid Kaveh, which it described as tied to the Electronic Warfare and Cyber Defence Organization of the Islamic Revolutionary Guard Corps. The government said the operation struck more than 700 retail sites during October 11–12 and targeted networked temperature controls in stores across the country.

French authorities said the attackers accessed web interfaces for refrigeration controllers, initiated abnormal and indefinite defrost cycles, and suppressed alert systems. Store managers reported soaring temperatures, with some systems rising by dozens of degrees, and losses that stretched across frozen and chilled inventory. Fire crews responded to multiple incidents, and reports counted at least 15 fires tied to overheated equipment and electrical stress during the wave of sabotage.

Law Enforcement Opens Case And Names Suspects

Paris prosecutor Laure Beccuau announced a criminal investigation focused on Shahid Kaveh and related actors. According to reporting on the prosecutor’s actions, authorities sought international arrest warrants for three alleged Iranian associates: Hamid Reza Lashgarian, Mahdi Lashgarian, and Reza Salarvand. French intelligence and cybersecurity services supported the case, and a joint assessment circulated among officials set the basis for the formal accusation and the pursuit of suspects tied to the operation.

The attribution rested on a consistent pattern seen across many victim locations, which pointed to a common playbook. Investigators and technical reporters described the same basic method repeated at scale: take over the controller interface, force long defrost states, and block alarms that would warn staff. That pattern matched the timing and the spread of affected retailers and logistics sites, giving officials confidence in both the scope and the intent of the campaign to cause real-world harm.

Iran’s Denial And France’s Next Steps

Iran’s foreign ministry rejected the accusation and called the French claims baseless. French leaders, however, framed the sabotage as unprecedented and said responses were under review, including potential sanctions and legal steps. Economic losses from ruined stock and equipment damage added pressure for action, while the investigation continued to gather evidence for any future prosecutions or coordinated international measures linked to the case.

Morning update, Sat 14 Nov. Four shocks to Western systems in under a week, and I find it hard to put that down to coincidence. France named Iran's IRGC for the supermarket fridge attacks on Monday. Microsoft 365 went down on Thursday, US airspace shut on Friday, and last night… pic.twitter.com/jHinUB1B4U

— OSINT Middle East Observer (@osintmeobserver) November 14, 2026

The French attribution also fits a broader record of cyber activity tied to Iranian state bodies and the Revolutionary Guard. Public tallies by governments and technology firms have linked dozens of cyber or influence operations to Iran over the past decade. Security studies and policy groups have also warned that Iranian operators target industrial and operational technology, a category that includes the kinds of networked controllers used in refrigeration and other building systems.

Why This Matters For American Stores And Critical Systems

Retail freezers in France may feel far from home, but the lesson lands here. Networked control systems run much of our daily life. Grocers, hospitals, schools, and small towns rely on web dashboards for heating, cooling, and alarms. Adversaries do not need bombs to cause chaos. They can flip software switches, kill alerts, and let heat and time do the damage. That is why strong passwords, vendor updates, and segmented networks are not “nice to have.” They protect jobs, families, and food supplies.

French officials said the campaign aimed to break things people touch every day and to scare the public. That is the new playbook: pick soft targets with high impact. President Trump’s team has pushed tougher critical infrastructure security and faster threat sharing with business. But owners still control many of the doors that attackers try first. Closing default logins, limiting remote access, and logging alerts can block a copycat strike. The French case shows the cost when those gaps stay open.

What Investigators Say Happened Inside The Stores

Attackers used exposed web panels to reach refrigeration controllers, according to French and independent reporting. Once inside, they queued defrost cycles that never ended, while alarms that should have notified staff stayed quiet. Temperatures rose fast, inventory spoiled, and motors overheated. Firefighters answered calls at several locations. The method was simple and repeatable across many brands and sites, which magnified the damage during a tight window in mid-October.

Officials in Paris tied the operation to a named Iranian unit after a joint assessment by intelligence and cyber agencies. The prosecutor’s office then moved to secure warrants for three identified suspects, signaling that the case is not just diplomatic talk but a criminal probe. While Iran denied involvement, France stood by its finding and prepared consequences. The core facts remain: the attacks were real, coordinated, and designed to cause physical harm through digital means.