France Blames Iran's Shahid Kaveh for Supermarket Fridge Hack

A bundle of converging clues

The attribution rests on a note from the Cyber Crisis Coordination Centre (C4). The first clue is infrastructure: the same servers were used in the same period for reconnaissance against Schneider Electric industrial equipment, including in small energy and water production sites. The C4 also links the fridge attack to simultaneous, limited-impact targeting of small French hydroelectric installations using this hardware.

The reconnaissance relied on Modbus, a widespread industrial communication protocol that uses network port 502. According to the C4, this has been Shahid Kaveh's signature since at least April 2026, when it was seen scanning Schneider Electric systems at scale, notably in France. The operators also used the FOFA scanning tool, which the group favors.

The choice of targets fits the unit's profile too. Shahid Kaveh runs large-scale sabotage campaigns against industrial equipment, mainly in Israel and the United States. In March 2026 it claimed attacks on industrial control systems there, including Israeli refrigeration equipment, and it has had scripts to scan and control Siemens, Schneider Electric and Rockwell hardware since at least June 2024.

Two less technical elements complete the picture. On 13 October, the attack was relayed by CyberbanNews, the propaganda outlet tied to the unit, which operates behind hacktivist fronts such as CyberAveng3rs and Soldiers of Solomon. Investigators also found traces of Farsi in the attack infrastructure. None of these would suffice alone, the C4 says, but together they point to Tehran.

What comes next

ANSSI director general Vincent Strubel said authorities remain cautious about a 2 November attack on three refrigeration units at the Établissement français du sang. The method is similar, but nothing yet shows the same attacker is behind it.

Paris prosecutors have requested international arrest warrants against Shahid Kaveh's leader and his two deputies. Foreign Minister Jean-Noël Barrot said France "rules nothing out" in its response, beyond European sanctions and the summoning of Iran's ambassador.