Trail of hackers who attacked supermarket refrigerators in France leads to Iranian IRGC unit

French prosecutors are investigating an attack on refrigeration equipment controllers that affected about 700 retail locations. The suspected group Shahid Kaveh, linked to the IRGC and under US sanctions, previously attacked industrial controllers in the US, the UK, and energy facilities.

Aziz KarimovFirst published on tafs uz 10 November 2026 at 08:052 min read

The key facts

France has opened an investigation against Shahid Kaveh, an IRGC unit under US sanctions
The attack affected about 700 stores in France through Danfoss and Dixell controllers
The same type of equipment was previously compromised in the US and the UK

Investigation in France

French prosecutors opened an investigation on Monday against Shahid Kaveh, a unit of the cyber command of the Islamic Revolutionary Guard Corps that is under US sanctions. Its leader, Hamid Lashgarian, was added by Washington to the sanctions list in 2024, with a $10 million reward offered for information on his activities. According to The National, the accused hackers attacked refrigeration equipment controllers in supermarkets made by Danfoss and Dixell, affecting about 700 mass retail locations across France.

The same type of vulnerability — in the US and the UK

Attacks by this group on similar equipment were first recorded back in late 2023: at that time, a joint advisory from CISA, the FBI, the UK's National Crime Agency, and Israeli and Canadian cyber centers reported the hacking of Unitronics programmable logic controllers used in water supply, energy, the food industry, and healthcare. This year, US agencies reported the compromise of other PLCs at critical infrastructure facilities, including energy and water utilities. After Shahid Kaveh shut down an energy facility in July, the UK's National Cyber Security Centre sent a warning to energy companies; the Department of Energy stressed that it was a small station that posed no risk to the power grid as a whole.

Why small operators suffer

According to a report by Tenable, the group, also known as CyberAv3ngers, has 'repeatedly compromised small water utilities, municipal facilities, and rural energy providers,' and the reason is structural: such organizations often use remote access tools that expose controllers directly to the public internet. This explains why the same type of attack recurs in different countries — from supermarkets in France to utility systems in the US and the UK.