Shahid Kaveh fridge attacks: French supermarket refrigeration ICS — IRGC hackers altered defrost settings, spoiled food, 15 fires (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
France's foreign ministry formally attributed the October 11–12 cyberattacks on industrial refrigeration controllers at ~700 French supermarkets and food facilities to Shahid Kaveh, an IRGC offensive cyber unit tied to the Guards' Electronic and Cyber Center. Attackers used FOFA to find internet-exposed devices, then remotely raised defrost/temperature setpoints, forcing continuous heating cycles that spoiled food, caused tens of millions of euros in losses and at least 15 fires. Affected chains include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, plus butcher shops, a slaughterhouse and cooperatives; related Schneider Electric ICS attacks hit small hydroelectric sites and a French blood service incident was detected. Paris prosecutors opened an investigation into the unit's head and deputies; EU sanctions are planned. A second wave on 2 November hit stores in nine+ European countries (attribution unclear). CISA/FBI published a fact sheet on the TTPs: authentication bypass, code injection and weak settings on exposed controllers. No patch applies—defenders must secure exposed OT devices.
What to do
- Audit internet-facing industrial refrigeration/ICS controllers and remove public exposure; check FOFA/Shodan exposure
- Review and lock down defrost and temperature setpoint configurations; define safe setpoint limits and enable alerting on out-of-band changes
- Segment OT/cold-chain networks from IT and internet; enforce phishing-resistant MFA, updated firewalls and VPN hardening on remote access
- Change default passwords, patch firmware, replace unsupported devices, allowlist approved devices/IPs for setting changes, and enable and review logging
- Apply vendor guidance for Schneider Electric and other ICS equipment; monitor FBI/CISA advisories for IOCs
- Verify integrity of stored food/pharma/blood products after any anomalous temperature or defrost activity; keep tested offline backups
Sources
All live incidents on Threat Watch
