CyberAv3ngers / IRGC Shahid Kaveh supermarket refrigeration sabotage — France blames Iran for hacks of refrigeration controllers at 700+ grocery stores
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
France's Cyber Crisis Coordination Centre (C4) and Foreign Ministry attributed October destructive cyberattacks on refrigeration controllers at more than 700 French grocery stores to the IRGC's Shahid Kaveh cyber unit, better known as CyberAv3ngers. Attackers raised freezer temperatures to 50°C, causing at least 15 fires and tens of millions of euros in food losses across Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. France called it the first cyber offensive campaign carried out purely for sabotage on national territory, citing shared infrastructure, known Shahid Kaveh techniques and traces of Farsi. Similar attacks hit Belgium, Ireland, Luxembourg and Sweden in early November. France vows responses including proposed EU sanctions and reserves the right to further measures.
What to do
- Audit internet-facing industrial controllers and refrigeration/OT devices; isolate them from the public internet behind VPNs and firewalls
- Change default and factory-set credentials on all ICS/OT equipment, especially unitary controllers
- Apply vendor firmware and software updates for Schneider Electric, Siemens and Rockwell devices
- Monitor for anomalous setpoint changes and unauthorized access to building-management and refrigeration systems
- Review US CISA/French ANSSI guidance on CyberAv3ngers TTPs and hardening recommendations for water, energy and food-sector OT
Sources
All live incidents on Threat Watch
