France attributes cyberattacks to Iranian units after supermarket refrigeration hit

France's CERT-FR has attributed a campaign of cyberattacks against French interests to two Iranian military cyber units, identifying an October 11–12, 2026 attack on industrial refrigeration controllers among the incidents. The agency described the refrigeration attack as unusually extensive and aggressive.

The National, citing Paris prosecutors, reported that the refrigeration attack affected about 700 retail sites across France and targeted controllers manufactured by Danfoss and Dixell. The newspaper also said French authorities opened an investigation into Shahid Kaveh on Monday.

CERT-FR said members of France's Cyber Crisis Coordination Centre, known as C4, attributed attacks intended to destabilise French interests to Shahid Shoostari and Shahid Kaveh. It identified both as offensive cyber units within the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command.

The National reported that the accused hackers exploited weaknesses in equipment similar to systems used in the United States and Britain. Technical details connecting the French refrigeration incident to attacks in those countries were not clear.

The equipment at issue belongs to a wider class of industrial controls. Programmable logic controllers, or PLCs, are computers designed to automate machinery and industrial processes, The National explained. Their uses extend beyond refrigeration to manufacturing and critical infrastructure.

The newspaper traced earlier concerns to an international warning in late 2023, which it said linked Shahid Kaveh to compromises of PLCs manufactured by Israel-based Unitronics. It also reported that US agencies identified similarities between further PLC compromises in 2026 and an attack attributed to the unit.

In Britain, The National reported that the National Cyber Security Centre alerted energy companies after a July shutdown at an energy site attributed to Shahid Kaveh. The Department for Energy Security and Net Zero said a small plant was affected, without endangering the broader energy system, according to the newspaper.

CERT-FR placed the refrigeration incident within attacks observed since at least 2020. Earlier targets included Charlie Hebdo in 2023 and a French video-display company in 2024, with the latter incident connected to the Paris Olympic and Paralympic Games, the agency said.