France names an IRGC cyber unit for the supermarket fires and promises sanctions in Brussels

France’s national cybersecurity agency ANSSI on Monday attributed the 12 October attack on supermarket refrigeration systems to “Shahid Kaveh,” described as a cyber-offensive unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps. BleepingComputer reports the attribution was produced by France’s Cyber Crisis Coordination Center, which includes ANSSI, military cyber command and the intelligence services, rather than by ANSSI alone. About 700 retail sites were affected, from supermarkets to butchers' shops — roughly 700 of France’s 10,000 supermarkets, in the Associated Press’s framing. The Paris prosecutor’s office counted “roughly twenty fires” in a single night; BleepingComputer puts the figure at at least fifteen. Several small hydroelectric plants suffered what ANSSI called moderate effects, and several blood banks were targeted without damage to products or samples. Foreign Minister Jean-Noël Barrot, speaking at G7 talks in Paris, called it “the first large-scale cyberattack aimed at sabotage on French soil.”

The method, as described by the prosecutor’s office, was mundane and precise: “The attackers gained remote control of the equipment via web interfaces, initiating indefinite, abnormal defrost cycles while simultaneously disabling safety alerts — alerts designed to trigger when temperatures exceeded specific thresholds.” Paris prosecutor Laure Beccuau opened a judicial investigation on 9 November into organised cybercrime committed to serve a foreign power, naming the head of Shahid Kaveh and his two deputies. Barrot said the Iranian ambassador was summoned “to lodge a very strong protest against this extremely grave act,” and that France would “impose sanctions at the European level against all those responsible.” The published attribution basis is thin: per the prosecutor, “an attack methodology characteristic of this unit, including the use of the Persian (Farsi) language and IP addresses that trace back to devices located in Iran.” BleepingComputer reports a November second wave hitting more than 115 stores across six European countries; CNN notes similar attacks in Sweden, Belgium and Ireland and says it is unclear whether they are linked.

Assessment: Language artefacts and source IPs are the two weakest pillars in attribution work, and Paris is almost certainly sitting on intelligence it has not published. The test is whether ANSSI or the C4 releases indicators, samples, or the Schneider Electric reconnaissance detail BleepingComputer describes. If it does, the case moves from political to technical; if it does not, the sanctions file rests on classified assurance. Two other things to track. Iran had not denied anything at the time of compiling — Tehran usually denies inside 24 hours, and silence here would itself be a signal. And the EU cyber sanctions regime has been used sparingly: Barrot has committed France, not the Council. The number that decides whether this is an incident or a campaign is the 115-plus stores in November, not the 700 in October.