Iran-linked cyberattack targets European supermarkets and critical infrastructure: What we know so far

France has formally attributed a series of cyberattacks on approximately 750 supermarkets in October 2026 to Shahid Kaveh, a hacking unit linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The attackers remotely manipulated refrigeration systems, causing food spoilage, equipment damage and fires.

The French Foreign Ministry announced the attribution on November 9, describing the operation as the country’s first offensive cyber campaign conducted exclusively for physical sabotage. The attacks also affected butcher shops, slaughterhouses, food processing facilities and Schneider Electric equipment at hydroelectric plants.

• France attributes the October attacks on approximately 750 supermarkets to Shahid Kaveh, an Iranian cyberunit associated with the IRGC.
• Hackers exploited internet-exposed refrigeration controllers and weak passwords, reportedly raising temperatures to 50°C and damaging food supplies.
• Similar operations have targeted US water systems, Israeli industrial equipment and other critical infrastructure, raising concerns about cyberattacks causing physical damage.

A second wave of suspected attacks on November 2 targeted refrigeration equipment in at least nine European countries. Authorities have not publicly established who was responsible for those incidents.

How hackers disabled refrigeration systems at 700 French supermarkets

On October 11-12, attackers gained remote access to refrigeration controllers used by French supermarkets and food businesses.

Instead of stealing customer information or encrypting corporate data, the hackers manipulated the equipment’s operating settings. Refrigerators and freezers were heated to temperatures approaching 50°C, destroying refrigerated products and contributing to equipment failures and fires.

The affected businesses included supermarket chains, meat-processing facilities and agricultural cooperatives. Industrial cooling equipment at France’s national blood bank was also reportedly compromised in a separate incident.

The attackers used legitimate refrigeration control functions, including defrost settings, to turn an ordinary remote-management feature into a method of physical sabotage.

According to France’s National Cybersecurity Agency (ANSSI), the intrusion relied heavily on basic security weaknesses.

Many affected controllers were directly accessible from the internet, protected by weak or default passwords, or running outdated software without adequate security updates.

The attackers reportedly located exposed equipment through Shodan, a search engine that indexes internet-connected devices. Once authenticated, they could change operating parameters without requiring sophisticated malware or direct physical access.

The incident exposed vulnerabilities in operational technology (OT), which connects digital control systems to physical machinery.

France identifies Shahid Kaveh as the Iranian hacking unit responsible

On November 9, French authorities attributed the October operation to Shahid Kaveh, which operates under the IRGC Cyber Electronic Command.

The unit is associated with CyberAv3ngers, an Iranian hacking group previously linked to attacks on industrial control systems in the United States and Israel.

French investigators identified similarities between the malware and tools used against European refrigeration systems and earlier CyberAv3ngers operations.

The attacks also resembled incidents involving Israeli food facilities, including a food-processing plant where refrigeration compressors were reportedly destroyed and company computers wiped.

French authorities linked Shahid Kaveh to the October sabotage campaign, while investigators continue examining connections between Iranian hacking groups that share personnel and technical tools.

Another group, Cyber Isnaad Front, claimed responsibility for attacks on Israeli refrigeration equipment.

France has associated this group with Shahid Kaveh, although other cybersecurity research has linked it more closely to Shahid Shushtari, a separate IRGC-affiliated unit. The organizational overlap makes precise attribution difficult.

US authorities have identified senior IRGC cyber officials associated with multiple operations. Amir Yaryab has been linked to both Shahid Shushtari and CyberAv3ngers, while Mohammad Bagher Shirinkar has been identified in sanctions and investigations involving these organizations.

French prosecutors have issued international arrest warrants for IRGC cyber operatives, and the French government has announced plans for additional sanctions.

Iran denies responsibility for the attacks. Its ambassador to France, Mohammad Amin-Nejad, rejected the allegations and suggested that another country could be responsible.

Second wave of cyberattacks hits refrigeration equipment across Europe

On November 2, another series of suspected cyberattacks disrupted refrigeration systems in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.

The incidents affected supermarkets and food-related businesses, raising concerns that the October operation had either expanded geographically or prompted copycat attacks.

The identity of the perpetrators remains unconfirmed. The attacks shared several characteristics with the French campaign, particularly their focus on commercial refrigeration equipment connected to remote monitoring and maintenance networks.

However, similarities in equipment, vulnerabilities and attack methods do not establish that the same group conducted both operations.

Investigators have not confirmed whether the November attacks were directed by Iran, carried out by affiliated groups or conducted independently by other hackers.

The incidents demonstrate how widely used industrial equipment can expose multiple organizations to the same security risks.

Refrigeration controllers often remain connected to the internet so maintenance contractors can monitor temperatures, identify faults and adjust operating settings remotely.

Compromising these systems can interrupt food distribution, destroy temperature-sensitive products and create safety risks without penetrating an organization’s main corporate network.

Iranian cyber operations extend to US water systems and energy infrastructure

The European incidents follow earlier attacks associated with Iranian hackers against industrial control systems in the United States.

In November 2023, CyberAv3ngers compromised Israeli-made Unitronics programmable logic controllers used by American water utilities.

Similar equipment had previously been targeted in Israeli distribution centers and irrigation systems.

In July 2026, a cyberattack affected more than 30 community water systems in Minnesota. US authorities subsequently warned about threats to water and wastewater infrastructure, with facilities in multiple states reporting incidents.

US investigators are also examining suspected cyber intrusions involving military commissary refrigeration systems and two oil tankers travelling towards Texas.

The possible Iranian connection to the tanker incidents has not been conclusively established.

Programmable logic controllers operate pumps, refrigeration equipment, industrial machinery and other essential infrastructure. Unauthorized access can allow attackers to disrupt physical processes rather than simply steal information.

A separate attack attributed to Iran-linked hackers reportedly forced a small British power plant offline for four days in July.

These incidents indicate growing interest in disrupting operational technology, where digital compromises can produce financial losses, service interruptions and physical damage.

Cyberattacks shift from data theft towards physical sabotage

Iranian cyber operations have historically included espionage, website disruption, destructive malware and the theft and publication of sensitive information.

One prominent example was the 2012 Shamoon attack against Saudi Aramco, which destroyed data on tens of thousands of computers.

More recent operations have increasingly involved systems controlling industrial processes.

Two techniques are particularly significant: data-wiping malware that disables corporate computers and direct manipulation of industrial controllers that govern physical equipment.

The latter can have immediate consequences for electricity distribution, water treatment, food storage, manufacturing and healthcare. The increasing use of internet-connected equipment has also expanded the number of potential entry points.

According to the European Repository of Cyber Incidents, 4,932 politically significant cyber incidents were recorded worldwide between January 2000 and November 2026, with approximately two-thirds occurring since 2022.

Government institutions accounted for nearly 40% of targets, while critical infrastructure represented the second-largest category.

Critical infrastructure operators face growing security risks

The French refrigeration attacks highlight the operational consequences of insufficiently secured industrial equipment.

France’s cybersecurity authorities said elementary weaknesses, particularly publicly accessible controllers and inadequate authentication, contributed to the incidents.

The US Cybersecurity and Infrastructure Security Agency had already issued a warning concerning vulnerabilities in refrigeration equipment in February 2026.

The affected organizations had not consistently implemented the recommended safeguards.

Security specialists have called for stronger separation between business networks and industrial control systems, removal of direct internet exposure, improved authentication and timely software updates.

They have also proposed closer intelligence-sharing between France, the United States and Israel, alongside coordinated exercises testing industrial incident response and recovery.

France’s planned sanctions and criminal proceedings address the suspected operators, but the underlying technical vulnerabilities remain a separate problem.

The incidents demonstrate that attackers do not necessarily need advanced tools to cause physical disruption. Access to poorly protected industrial controllers can be sufficient to damage equipment, interrupt essential services and generate substantial economic losses.