France Blames IRGC Unit for Oct. 11 Refrigeration Sabotage at ~700 Sites; Public Case Is Circumstantial

On the night of October 11, operators took remote control of Danfoss and Dixell refrigeration controllers at about 700 French retail sites through exposed web interfaces, the Paris prosecutor's office said. They forced unlimited defrost cycles and disabled high-temperature probe alerts. Food spoiled. Fires followed: at least 15 in one official telling, about 20 in another. Losses were estimated at several tens of millions of euros. Named victims include Casino, Carrefour, Leclerc, Intermarché, Metro and Coopérative U, plus butchers, a slaughterhouse and food plants. The same period saw moderate effects on Schneider Electric equipment at small hydroelectric sites.

C4, France's cyber crisis cell spanning ANSSI, DGSE, DGSI, the armament directorate and cyber defense command, lists four indicators for an IRGC element it names Shahid Kaveh. Attack infrastructure also reconnoitered Schneider gear at energy and water sites, using techniques C4 dates to April and the FOFA scanner. CyberbanNews, a linked propaganda outlet, described the incident by October 13. Prosecutors add Persian-language traces, IPs tied to devices in Iran, and a method they call typical of the unit. No public malware report or hash set accompanies that assessment.

The ministry calls this the first purely sabotage cyber campaign on French soil, run by Shahid Kaveh behind personas CyberAveng3rs and Cyber Isnaad Front. That is an official claim, not a published technical attribution. Persona history is real in the record: a CyberAv3ngers brand claimed Unitronics PLC attacks in November 2023, and CISA linked that activity to IRGC-affiliated operators hitting exposed industrial controllers. IPs in Iran and Persian traces fit Iranian infrastructure and also fit proxies. Paris does not mention a reported refrigeration wave against supermarkets elsewhere in Europe days later. Independent confirmation is not in the public file.

The bill hits retailers, insurers and shoppers: spoiled stock, fire repairs, disposal, and a cold chain that failed in public. The quieter signal is target development. The same infrastructure was mapping Schneider equipment at small energy and water sites. Paris will summon Iran's ambassador, ask EU partners for new sanctions, and has sought arrest warrants for the unit head, two deputies and others. Charges are unlawful interference and damage by dangerous means, aggravated as service to a foreign power. Watch whether CERT-FR publishes indicators operators can hunt. If it does not, the case remains a classified assertion.