3BQRIIINO. INDEPENDENT TECH JOURNAL
← All stories

Cybersecurity / Iran / Critical Infrastructure / Hacking · November 11, 2026

The Hackers Who Attacked the Fridges: Who Is Shahid Kaveh, the IRGC Cyber Unit France Just Named?

France says an IRGC cyber unit called Shahid Kaveh — better known online as CyberAveng3rs — sabotaged refrigeration at some 700 French supermarkets in October, spoiling food and starting fires. Who they are, how France built its case, and what is not proven.

The Hackers Who Attacked the Fridges: Who Is Shahid Kaveh, the IRGC Cyber Unit France Just Named?

In the night of 11–12 October 2026, something quietly went wrong inside hundreds of French supermarkets at the same time. The refrigeration controllers that keep fridges and freezers at temperature were remotely reprogrammed: defrost cycles were set to high temperatures, and the cold chains began to warm. By morning, stores across the country were throwing away spoiled food — losses France puts at several tens of millions of euros — and at least 15 fires had broken out. On 9 November 2026, France said it knew who did it, and named them in public: Shahid Kaveh, an offensive cyber unit of Iran's Islamic Revolutionary Guard Corps. Foreign Minister Jean-Noël Barrot called it the first large-scale cyberattack aimed purely at sabotage on French territory, and the first time France has directly accused Tehran of a cyberattack. What follows is what France's assessment actually says, who this unit is, and — just as important — what has not been proven.

What actually happened: the most mundane critical infrastructure there is

According to the report by France's Cyber Crisis Coordination Centre (C4) — the inter-agency body that brings together the ANSSI cybersecurity agency, military cyber command, the DGA armaments agency and the DGSE and DGSI intelligence services — the attackers reached the refrigeration controllers of about 700 retail sites through their exposed web interfaces. The sites named in the report include stores of Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, and the same operation reached beyond retail: a slaughterhouse, food-processing plants, and small hydroelectric sites running Schneider Electric equipment were also hit.

The technique was not exotic. Industrial refrigeration controllers — units from makers such as Danfoss and Dixell are named in the incident reporting — are designed to be managed remotely, and when that management interface is reachable from the open internet with weak or default access, anyone who finds it can change the settings. The attackers changed one setting that mattered: defrost, pushed to high temperatures. No malware sophistication was required to turn a supermarket chain into a sabotage target; the door was a settings page.

That is the uncomfortable lesson of the October attack, and it generalises far beyond France. The equipment that runs water plants, food logistics, heating and small power stations increasingly sits online, searchable by anyone, and protected by little more than a password the installer never changed.

Who is Shahid Kaveh?

France's C4 report identifies Shahid Kaveh as an offensive cyber unit operating inside the IRGC's Electronic and Cyber Centre (IRGC-CEC) — the Revolutionary Guards' cyber and electronic-warfare arm. (A second unit in the same centre, Shahid Shoostari, is blamed in the same French assessment for earlier operations against French interests, including the 2023 Charlie Hebdo attack and a 2024 incident during the Paris Olympics; those are separate attributions from the supermarket case.)

France named three men. Hamid Reza Lashgarian heads the IRGC-CEC. Mahdi Lashgarian and Reza Salarvand are identified as Shahid Kaveh's commanders. In public, the unit rarely appears under its own name: per the C4 report it operates behind hacktivist-style personas — CyberAveng3rs (US agencies spell it CyberAv3ngers), Soldiers of Solomon, Mr. Soul and the Cyber Isnaad Front — and publicises its operations through a media outlet called CyberbanNews. Those personas are presented by the unit as independent vigilante hackers; France and the United States both treat them as fronts for the same IRGC organisation.

The track record: from American water plants to a $10 million bounty

The CyberAveng3rs name first became widely known in November 2023, when the persona claimed attacks on US water infrastructure. A joint advisory from CISA and partner agencies (AA23-335A) concluded that the actors compromised at least 75 US-based Unitronics programmable logic controllers between November 2023 and January 2024 — at least 34 of them in water and wastewater facilities — by logging in over the internet where default passwords or no password were in place. The most famous case hit a booster station of the Municipal Water Authority of Aliquippa, Pennsylvania, which had to switch to manual operation; the compromised screens carried an anti-Israel message.

Washington's response escalated in steps. On 2 February 2024, the US Treasury sanctioned six IRGC-CEC officials over the PLC campaign — including Hamid Reza Lashgarian, identified as the IRGC-CEC's head and a Qods Force commander, and Mahdi Lashgarian. In August 2024, the State Department's Rewards for Justice programme offered up to $10 million for information leading to the identification or location of the same six men. CISA's later advisories state the equivalence plainly, referring to "CyberAv3ngers (aka Shahid Kaveh Group)". The unit France named on Monday is, on the US record, the same organisation that was defacing American water-plant screens three years ago — now accused of moving from defacement to physical sabotage.

How France built the attribution

Attribution is an assessment, and the C4 report presents a bundle of converging indicators rather than a single smoking gun:

France's foreign ministry formally declared the attribution on 9 November; the CERT-FR report (CERTFR-2026-CTI-009) was published the same day.

Warrants, an ambassador, and a sanctions push

The response ran on legal and diplomatic tracks at once. Paris prosecutor Laure Beccuau opened a judicial investigation against the unit's head, his two deputies and unidentified others, and her office is seeking international arrest warrants. The offences under investigation include illegal interference with computer systems and causing damage dangerous to people, aggravated — in the French framing — by acting for a foreign power; the investigation is being run with the police anti-cybercrime office and the DGSI. On 10 November, France summoned Iran's ambassador in Paris, and Barrot said France would propose new EU sanctions against the organisations and individuals involved, reserving further measures "we deem proportionate and necessary", including some it may not disclose.

What is not proven

Three boundaries matter, and honest coverage has to keep them sharp.

First, France attributed only the October French wave. A larger series of refrigeration attacks hit stores in other European countries on 2–3 November, and cold rooms at a French blood service were hit in the same period. The C4 report does not cover those incidents and France has not attributed them to Shahid Kaveh; linking them to the unit would go beyond the evidence Paris has published.

Second, Iran denies it. Tehran's foreign ministry categorically rejected the accusations as "baseless" and one-sided, saying France was projecting its own governance failures; Foreign Minister Abbas Araghchi mocked Paris on X, writing that a government "unable to manage fridges" was shifting blame for its failures onto others.

Third, an attribution is not a court finding. It is the French government's official assessment, built on intelligence and technical indicators that have not been tested in a courtroom. The judicial investigation may eventually test parts of it; until then, "France says" is the accurate verb — including in this article.

Why this matters beyond France

Strip away the geopolitics and the October attack is a story about a settings page. The same class of internet-exposed controller sits in food warehouses, water plants, hospitals and small utilities in every country, and the attackers' method — scan for the device, log in, change the one setting that does damage — does not require a superpower's budget, only its patience. ANSSI used its October alert to repeat the advice it and agencies like CISA have given for years: never expose a controller's management interface to the open internet, put remote access behind proper authentication, and change factory credentials. France learned in one night what that advice is worth when it is ignored at scale: several tens of millions of euros of food, fifteen fires, and a diplomatic crisis — caused, on France's account, by hackers who attacked the fridges.

Sources and classification

Classification: Confirmed News — the French government's public attribution of 9 November 2026 and the prosecutorial and diplomatic actions that followed are matters of official record. The attribution itself is the French state's assessment, framed as such throughout; the group's alleged responsibility has not been established by a court, and Iran's denial is carried above. Checked 11 November 2026.

Prefer reading in Arabic? You can translate this article into Arabic with Google Translate.