France Blames an IRGC Unit for Supermarket Refrigeration Sabotage and Prepares a Sanctions Push
By The Israel Desk NewsroomPublished:
France accused Iran’s Islamic Revolutionary Guard Corps of directing the cyberattack on supermarket refrigeration systems in October and announced on November 9 that it would summon Iran’s ambassador and seek additional European sanctions. Its technical assessment identifies the Shahid Kaveh unit as the operator behind the sabotage.
The attribution gives the incident a direct connection to a cyber campaign against Israeli and American industrial equipment. French investigators say the same unit conducts operations against those countries and has extended its targeting to France and other European states.
Refrigeration settings were turned against the equipment
France’s interagency cyber crisis coordination center, known as C4, said it was alerted on October 12 after refrigeration controllers were compromised during the preceding night. Defrost settings had been raised to high temperatures, causing substantial stock losses and fires in at least 15 cases.
The Foreign Ministry’s November 9 statement describes more than 700 retail sites. C4’s report, issued the same day, says about 700. The documents do not resolve that difference. The ministry estimated spoiled food losses at tens of millions of euros and also reported considerable material damage.
C4 named affected retail groups including Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. It also identified victims elsewhere in the food sector, including small butcher shops, a slaughterhouse and cooperative food processing plants. The operational effects therefore extended beyond supermarket shelves into the facilities that supply them.
The attribution rests on several technical indicators
The French assessment places Shahid Kaveh inside the Revolutionary Guards’ electronic and cyber organization. C4 brought together France’s cybersecurity agency ANSSI, its domestic and external intelligence services, its defense procurement agency and its military cyber command to assess the activity.
Investigators described overlapping attack infrastructure, reconnaissance of other industrial devices, recurring scanning methods and traces of Farsi in the infrastructure. The report presents these as a combined body of evidence supporting attribution to the Iranian unit.
C4 also linked concurrent targeting of equipment at small French hydroelectric installations to the same attack. It characterized the effects there as moderate. The report’s description of those facilities is narrower than its account of the damage to refrigeration systems.
An established connection to Israeli technology
The industrial equipment connection predates the French incident. A joint advisory issued by American agencies and Israel’s National Cyber Directorate in December 2023 documented attacks on Israeli manufactured Unitronics programmable logic controllers, devices used to operate physical processes.
The advisory described compromised equipment at water and wastewater facilities in multiple American states. The affected controllers were exposed to the internet and used default passwords. It also identified food production, energy and healthcare among the industries that use such devices.
That record helps explain why an attack associated with Israel can have consequences in other countries: equipment made by an Israeli company operates inside foreign utilities and businesses. The 2023 advisory addressed the compromised controllers directly and warned operators to review related control networks as well.
Previous American sanctions targeted the cyber command
The U.S. Treasury sanctioned six officials of the Revolutionary Guards’ cyber command on February 2, 2024, in response to operations against Unitronics equipment. Treasury said that particular operation had not interrupted critical services and that the incidents had been remedied with minimal effects.
Its warning concerned what unauthorized access could enable. Controllers used in essential services connect digital instructions to physical equipment, creating risks beyond stolen information or a defaced website. The French findings now describe actual stock destruction and fires after settings were changed.
The American action blocked the designated officials’ property under U.S. jurisdiction and generally prohibited covered transactions. It provides an earlier example of the sanctions route France announced it would pursue through its European partners.
Paris announces diplomatic action and a European proposal
France’s Foreign Ministry said it would summon the Iranian ambassador to convey its condemnation and propose sanctions against Iranian individuals and entities involved in the attack and other malicious cyber activity. It also reserved the option of additional public or undisclosed measures it considered necessary and proportionate.
The November 9 announcement sets out intended diplomatic steps; it does not announce adoption of a new European sanctions package. Paris characterized the October operation as its first offensive cyber campaign conducted purely for sabotage on French territory, an assessment attributed to the French government.
The immediate development is the public identification of an Iranian state unit and the decision to seek a coordinated response. For operators of industrial systems, the accompanying record connects that diplomatic move to a specific physical failure: remote changes to refrigeration controls that destroyed goods and, in at least 15 cases, started fires.
