← The feed Many Minded · The brief
SECURITY · friction · impact 3/5 · 2026-11-09

Paris pins October grocery refrigeration sabotage on an Iranian unit

France's cyber crisis centre says Iran's IRGC-linked CyberAv3ngers hit fridge controllers at 700+ stores, sparking fires and costing tens of millions of euros.

On Monday 9 November 2026, France's Cyber Crisis Coordination Centre (C4) published a report blaming Iran for October attacks on refrigeration controllers at more than 700 grocery stores. Affected chains were Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. The C4 says the attacks started at least 15 fires and destroyed food worth tens of millions of euros. The foreign ministry called it the first cyber campaign carried out purely for sabotage on French soil.

The report names the IRGC's Shahid Kaveh unit, also known as CyberAv3ngers, and says it has been able to scan, access and control Schneider Electric, Siemens and Rockwell industrial equipment since at least June 2024. French evidence includes shared attack infrastructure used to scout Schneider equipment at small energy and water operators, techniques tied to the unit since at least April 2026, traces of Farsi, and a group reportedly linked to the unit that publicized the 11-12 October incidents by 13 October.

The lesson for food abundance is about fragility. Cheap, plentiful food depends on an unglamorous cold chain, and that chain runs on internet-reachable controllers made by a handful of vendors. Spoiled stock and fires raise costs and cut supply, and the same equipment sits in water and energy systems. Similar fridge and freezer attacks, with temperatures pushed as high as 50°C, were reported in early November in Belgium, Ireland, Luxembourg and Sweden.

France says it will use all available means, propose more EU sanctions on Iranian entities and individuals, and condemn the attacks to Iran's ambassador. Caveats: the attribution comes from the French government and the C4 report, with no independent verification reported. The link between the November incidents elsewhere in Europe and the French campaign is not established. CyberAv3ngers is also suspected in July attacks on over 100 exposed US water systems, which the US government has not attributed, though private analysts blamed Iran.

Source: The Register