France summoned Iran's ambassador on 10 November after blaming the IRGC's Shahid Kaveh unit for refrigeration sabotage that sparked at least 15 fires.
Iran's ambassador was called in at the French foreign ministry in Paris on Tuesday morning, 10 November 2026, over the refrigeration cyberattacks.
France went public with the accusation a day earlier, on Monday 9 November 2026, blaming Iran for the operation that hit about 700 refrigeration systems during the night of 11-12 October 2026; Paris named the IRGC Cyber and Electronic Command as the body that ordered the attack and the Shahid Kaveh unit as the one that carried it out. Foreign Minister Jean-Noël Barrot said the campaign was unprecedented in its scale and level of aggression.
This is an unprecedented campaign in terms of its scale and level of aggressiveness, thus constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory
Hackers got at the cold chain through the defrost settings on refrigeration controllers, pushing temperatures to nearly 50°C (122°F); cooling units sat at about that level for roughly six hours, long enough to force stores to throw out fresh and frozen goods. The C4 report, an assessment that accompanied the French accusation, recorded at least 15 fires.
The foreign ministry put the losses at several tens of millions of euros. The chains named among those affected were Carrefour, Intermarché, Monoprix, E-Leclerc, Coopérative U, Casino and Metro.
| Measure | Detail |
|---|---|
| Systems hit | about 700 refrigeration systems, per French officials and the C4 report; other accounts say approximately 700 supermarkets or more than 700 grocery stores |
| Peak temperature | nearly 50°C (122°F) |
| Duration | about six hours |
| Fires | at least 15, per the C4 report |
| Losses | several tens of millions of euros, per the foreign ministry |
| Retailers | Carrefour, Intermarché, Monoprix, E-Leclerc, Coopérative U, Casino, Metro |
| Root cause | exposed administration interfaces and weak passwords, per ANSSI |
The same operation reached beyond the supermarket aisle. Small butchers, an abattoir and cooperative food-processing plants appear among the compromised sites listed in the C4 report. Investigators also saw the attackers hit Schneider Electric equipment at small French hydroelectric installations at the same time, an effort the report ties to the same operation; effects were moderate, with no loss of power.
In Paris, prosecutor Laure Beccuau said a judicial investigation had been opened into the head of Shahid Kaveh, his two deputies and any other individuals who might be identified.
A judicial investigation has been opened against the head of the Iranian group Shahid Kaveh, an offensive cyber unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps (IRGC-CEC), against his two deputies, and against any other individuals who may be identified,
Her office requested international arrest warrants against the individuals named in the inquiry, though there's no confirmation that any have been issued. Accounts differ on the scope: one says warrants were sought for two suspected officials, while the prosecutor's own statement and other accounts name the unit's leader and his two deputies. The annex to the C4 report identifies Hamid Reza Lashgarian as head of the IRGC-CEC, with Mahdi Lashgarian and Reza Salarvand as Shahid Kaveh commanders.
Sanctions, and a warning left open
France would seek European-level sanctions against those responsible, Barrot said. Possible responses include excluding those deemed culpable from Europe and freezing their assets.
He said France could also use cyber operations or take other steps without making them public. Paris wasn't ruling anything out.
will not go unanswered
The unit has held industrial-control scripts since 2024
The C4 report said Shahid Kaveh had possessed scripts since at least June 2024 to scan, access and control equipment made by Schneider Electric, Siemens and Rockwell. In March and April 2026, the unit said it targeted Israeli and American industrial control systems in a large-scale sabotage campaign, including Israeli refrigeration equipment.
None of this required a zero-day. The attackers went after controllers supplied by Danfoss and Dixell, getting in through the equipment's online interfaces; ANSSI's assessment points to exposed administration interfaces and weak passwords rather than an exploit chain.
Investigators found that the attackers worked in Farsi, operating from IP addresses connected to equipment in Iran.
A second wave hit fridges across six countries
A second wave of similar attacks in November affected roughly 100 refrigerators across Estonia, Belgium, Luxembourg, Finland, Ireland and Sweden. Initial reports suggested the first wave also reached Spain, Portugal, Poland, Germany and Belgium. Whether the waves are directly related is unclear, and France hasn't attributed the November wave or the incident at the French blood service.
Two waves, one unresolved question of authorship
France, October 2026
Night of 11-12 October
- About 700 refrigeration systems hit
- Nearly 50°C for roughly six hours
- At least 15 fires
- Attributed to the IRGC-CEC and Shahid Kaveh
Europe, November 2026
Estonia, Belgium, Luxembourg, Finland, Ireland, Sweden
- Around 100 fridges hit in the second wave
- First-wave reports also named Spain, Portugal, Poland, Germany and Belgium
- Authorship unresolved
- France has not attributed it
A third incident hit Coolworld, which supplies the French Blood Establishment (EFS). Temperature spikes were noticed quickly and corrected, with no serious operational consequences.
The European Commission said the attacks could put Europe's food safety at risk. Estonia's interior minister, Igor Taro, said the perpetrators of the fridge hack remained unclear and called the sabotage state-sponsored terrorism.
Hybrid is too soft [a] word for this
Iran hasn't responded publicly to the French accusations, and Tehran has denied involvement in malicious cyber operations in the past. On Thursday, Moscow also denied playing a role in the most recent fridge hacks, AFP reported.
- June 2024Tool kit in place Shahid Kaveh holds scripts to scan, access and control Schneider Electric, Siemens and Rockwell equipment, per the C4 report.
- March-April 2026Israeli campaign The unit claims a large-scale sabotage campaign against Israeli and American industrial control systems, including Israeli refrigeration.
- 11-12 October 2026French attack About 700 refrigeration systems are hit, with Schneider Electric equipment at small hydro sites struck in the same operation.
- 2-3 November 2026European wave A wave of fridge attacks hits six countries. France does not attribute it.
- 9 November 2026Attribution Paris publicly blames Iran, naming the IRGC-CEC and Shahid Kaveh.
- 10 November 2026Summons Iran's ambassador is called in at the foreign ministry in Paris.
Where it stands: the ambassador was summoned, the arrest warrants were requested, and no confirmation has come that they were issued.
What we know
- France attributes the October attack to the IRGC-CEC and its Shahid Kaveh unit.
- The Paris prosecutor requested international arrest warrants against the named individuals.
- The C4 report recorded at least 15 fires.
Still unclear
- Whether the November wave across Europe is connected to the October attack.
- Who carried out the November wave and the incident at the French blood service.
- Whether Tehran will answer the French accusations publicly.
- Whether the requested arrest warrants have been issued.
