France blames Iran cyber unit for supermarket refrigeration hack

The French government has formally accused an Iranian cyber unit known as Shahid Kaveh of orchestrating a recent sabotage campaign against commercial refrigeration systems. The attack, which occurred in October, targeted hundreds of supermarket locations across France and resulted in the remote adjustment of temperatures, causing millions of euros worth of food to spoil. French Foreign Minister Jean-Noel Barrot described the incident as unprecedented in its level of aggression, marking a significant escalation in cyber conflicts involving Iran.

According to statements from the Paris prosecutor’s office, the offensive cyber unit is affiliated with the cyberelectronic command of the Islamic Revolutionary Guard Corps. The report specifically identified three alleged perpetrators involved in the operation. These individuals include Hamid Reza Lashgarian, described as the head of the cyberelectronic command, along with Mahdi Lashgarian and Reza Salarvand, who are identified as commanders within the Shahid Kaveh unit.

Iran has pushed back against the allegations, with the Foreign Ministry issuing a statement on Tuesday that dismissed the accusations as baseless and biased. The ministry characterized the French claims as a highly irresponsible move intended to tarnish Iran’s image and disrupt its international relations. While Tehran warned that it would not hesitate to take measures to safeguard its national interests and security, the statement did not explicitly mention the Shahid Kaveh unit by name.

The group’s existence has never been publicly acknowledged by the Iranian government, though Western intelligence agencies have long linked it to the IRGC. The unit appears to be named after Mahmoud Kaveh, an IRGC commander who died at the age of 25 during the Iran-Iraq war in 1986. French spy and cyber agencies noted that Shahid Kaveh operates through various front groups that pose as vigilante hackers. These fronts, which include entities called CyberAveng3rs and Cyber Isnaad Front, are tasked with publicly claiming responsibility for attacks carried out by the main unit.

Two of the individuals named in the recent report, Hamid Reza Lashgarian and Mahdi Lashgarian, have previously been sanctioned by the United States due to their alleged ties to the IRGC’s cyber operations. This connection underscores the ongoing scrutiny of Iranian cyber actors by Western powers, who view the unit as part of a broader network of hackers operating under Tehran’s direction.

Experts suggest that Iran is increasingly leveraging its extensive cyber capabilities to advance its strategic objectives. Nikita Shah, a senior fellow at the Center for Strategic and International Studies, noted a significant increase in Iranian cyberoperations since March 2026. He observed that these operations include cyberespionage and conflict-themed cybercrime, with operators likely preparing new technical accesses and capabilities in case the current conflict continues or negotiations fail.

A 2025 policy report by the United Kingdom Parliament’s Intelligence and Security Committee described Iran as an aggressive cyberactor with extensive capabilities. Although the report noted that Iran’s sophistication lags behind that of Russia and China, it highlighted Tehran’s adeptness at using basic exploitation methods effectively. The report emphasized that Iranian actors often exploit simple vulnerabilities that many organizations, including those in the UK, still maintain, using cyberoperations as a deniable tool to project power and respond to perceived aggression.

France is not the only country to have faced recent cyber threats from Iran-linked groups. The IRGC and its affiliates have been connected to past attacks on targets in the United States and Israel, including critical water infrastructure. In late 2023, a wave of attacks targeted US water facilities that relied on computer systems made by the Israeli software firm Unitronics. More recently, in March, an Iran-linked group claimed responsibility for a destructive cyberattack on Stryker, a US-based medical device provider.

US security agencies also warned earlier this year that Iran-affiliated hackers targeted industrial control technology in US infrastructure, including at government facilities. These actors disrupted programmable logic controllers across several critical infrastructure sectors, leading to operational disruptions and financial losses. The recent French intelligence report indicated that while attacks by Shahid Kaveh and its affiliated groups have primarily targeted Israel and the United States, France and other European countries have also come under fire.