France names Iran's Shahid Kaveh unit behind the supermarket fridge hacks; and Tehran calls it baseless

Paris names the unit, Tehran denies everything

On Monday 9 November, France did something it had very rarely done in public: it named a foreign state's cyber unit and blamed it for an attack on French soil. Foreign Minister Jean-Noël Barrot said he could confirm that Iran's Revolutionary Guards carried out the cyberattacks that overheated refrigeration systems in French supermarkets on the night of 11–12 October, calling the operation “unprecedented in its level of aggression”.

The Paris prosecutor, Laure Beccuau, opened a judicial investigation into the head of the unit France holds responsible, Shahid Kaveh, an offensive cyber unit affiliated with the Guards' electronic and cyber centre, and his two deputies, and requested international arrest warrants for all three. France summoned Iran's ambassador and said it would seek European sanctions.

On Tuesday 10 November, Iran's Foreign Ministry rejected the accusations as “baseless and biased”, calling them a “highly irresponsible and contemptible action to tarnish Iran's image”. Tehran said it would defend its interests, and made no mention of Shahid Kaveh at all.

Seven hundred sites, one cold chain, and a trail of clues

The attack struck on the night of 11–12 October, when hackers took control of the software that regulates temperatures in commercial refrigeration units, systems supplied by the Danish firm Danfoss that let retailers manage cold rooms remotely, and pushed defrost settings to high temperatures. Over 100 Coopérative U stores and about 180 Intermarché and Netto stores were hit, along with Carrefour, Monoprix and E.Leclerc outlets. In some stores, temperatures reportedly hit 50°C overnight. Tons of food were destroyed, losses run to several tens of millions of euros, and the attacks caused at least 15 fires. The October attacks were covered here when the shelves emptied: the first account of the supermarket refrigeration hacks.

France's attribution rests on a four-page report published on 9 November by the Centre de Coordination des Crises Cyber, the interministerial body bringing together ANSSI, the military cyber command, the armaments directorate and the intelligence services, with the national CERT-FR. The report says the attack infrastructure had also been used to scan Schneider Electric equipment, the operators used FOFA, a scanning service the unit habitually uses, traces of Persian were found in the infrastructure, and CyberbanNews, the unit's propaganda outlet, relayed the attack on 13 October.

The report names three men: Hamid Reza Lashgarian, 65, head of the Guards' electronic and cyber centre and a Quds Force commander; Mahdi Lashgarian, 37; and Reza Salarvand, 35, both described as Shahid Kaveh commanders. Hamid Reza and Mahdi Lashgarian were already under United States sanctions imposed in 2024 over alleged cyberattacks.

What remains unknown: the motive, the method, and the second wave

France has not published the underlying intelligence; only the technical indicators in the CERT-FR report. Attribution is extremely difficult, because attackers can hide their locations and plant false traces, and Paris has not explained what ruled out other suspects.

The motive is unclear. France, like other European countries, has kept a low profile in the war between Iran, Israel and the United States that resumed this year, and nothing in the French statement explains why French supermarkets were chosen; or why refrigeration was the weapon.

What is not known is whether the second wave of hacks in early November, more than 100 stores across Europe, and three French blood-service facilities on 1–2 November, is connected to the October attack at all. France has pointedly not attributed that wave to Iran. Nor is it known whether the fridge failures at about six United States military commissaries since late August, which Reuters has reported are under investigation as deliberate cyberattacks, share an author.

Why does an attack on fridges count as an attack on a nation?

The attack matters because of what it targeted. Supermarket refrigeration is civilian infrastructure: when it fails, the damage is measured in spoiled stock and fires rather than in stolen secrets. A sabotage operation against the food supply of a major European country is a different kind of event from the intrusions governments usually trade accusations over, and Barrot's language, a “major attack on the nation's interests and the security of the French people”, was chosen to say so.

It matters because France named names. Governments rarely attribute cyberattacks in public with this precision, because attribution exposes methods and invites retaliation. Doing so now, in the middle of a war in which France is not a belligerent, signals that Paris considers the cost of silence higher than the cost of confrontation; and Brussels said on Tuesday it would look for a “swift and united response” once member states have discussed the announcement.

And it matters because the unit France named is not new. Shahid Kaveh's front groups, operating under names such as CyberAveng3rs, have claimed attacks for years; including the compromise of at least 75 Unitronics controllers in the United States in November 2023 and attacks on refrigeration systems in Israel in March and April of this year. The French operation, if the attribution holds, is by far the group's most successful to date.

Naming the unit is the message

France's decision to name Shahid Kaveh in public is best read as deterrence by disclosure. Attribution is usually kept private because it burns sources and methods; publishing it is a deliberate choice to raise the price of the next attack. The message is aimed at Tehran, but also at every other state watching.

The choice of target is the second message. Refrigeration is soft, civilian and symbolic all at once: it empties shelves and forces a government to explain why its citizens' food is being thrown away. For an attacker that wants to impose costs without triggering a military response, it is close to ideal.

The risk for Paris is that the attribution becomes a ladder. Iran has denied the attack; France has promised sanctions and reserved undisclosed measures of its own. Each step is calibrated to stay below open conflict, but the resumed war in the Gulf has already blurred that threshold; and a cyber campaign, unlike a missile, can be denied, repeated and escalated without anyone declaring anything.

What happens next to the cold chain, the sanctions list, and the copycats?

The first consequence lands on the retailers. Supermarket groups across Europe are now auditing the remote-management software that runs their refrigeration, and the question of who can reach a cold room from the internet has become a board-level issue. The November wave guarantees the audit is happening in Belgium, Luxembourg and Sweden as well as in France. The wider pattern of freezer attacks and fires is documented in our earlier reporting on the fires and losses.

The second consequence is institutional. If the European Union follows France's lead with sanctions against the three named men and the entities around them, it will be the first time the bloc has sanctioned a state cyber unit over sabotage of civilian infrastructure. The bloc's discussion in the coming days is where the attribution turns into policy or stalls.

The third consequence is imitation. The French attacks showed that industrial controllers, the same class of device that runs water plants, energy sites and food factories, can be reached and turned into a weapon. The techniques are now described in a public government report. The defence side, artificial intelligence in cyber defence, is a race Europe is already running, as our coverage of AI in cyber defence sets out.

Sanctions, warrants, and the November wave

In the coming days, European Union member states will discuss France's request for sanctions, and Brussels has promised a swift and united response. The Paris prosecutor's investigation continues, and the arrest warrants will test whether the three men ever travel somewhere that would execute them.

Iran has said it will take the measures it deems necessary to safeguard its interests, and has accused France of projecting its own governance failures: “a government that cannot even manage the temperature of its own refrigerators”. The next development to watch is whether France attributes the November wave as well, or whether that wave, and the American base incidents, remain unattributed.