Iranian Hackers Also Targeted Hydroelectric Plants, French Government Says
David Meyer •
November 10, 2026
French authorities say Iran was behind the mid-October attacks that targeted hundreds of supermarket refrigeration systems whose poorly secured controllers enabled unauthorized remote access. (Image: Shutterstock)
France has formally blamed Iran for cyberattacks on refrigeration units in French supermarkets last month and for the simultaneous targeting of hydroelectric plants. The government called it “an unprecedented attack campaign in terms of its scale, its impact and the level of aggression observed.”
See Also: Your Face Is Your Boarding Pass: How Biometric Identity Is Redefining the Way We Travel
The mid-October attacks targeted hundreds of supermarket refrigeration systems whose poorly secured controllers enabled unauthorized remote access. The attackers caused temperatures to rise to as much as 50 degrees Celsius, or 122 degrees Fahrenheit. Millions of euros’ worth of food spoiled and had to be thrown away (see: Hackers Attack French Supermarket Freezers Causing Food Loss).
Similar incidents followed in other European countries at the start of this month. A hacker also unsuccessfully attempted to remotely sabotage cooling facilities at several French blood banks. No one has attributed those attacks, which may have been copycat incidents following the publicity surrounding the original campaign.
Attributing cyberattacks is difficult because perpetrators can cover their tracks. But the French Cyber Crisis Coordination Center, or C4, an interministerial body that includes cybersecurity agency ANSSI, appears certain about who was responsible for the mid-October supermarket campaign and other incidents that took place at the same time.
In a statement Monday, C4 said attackers targeted controllers in approximately 700 large supermarkets, causing at least 15 fires. Other victims included several small butcher shops, a slaughterhouse and cooperative food processing plants. C4 also said it had “observed the concomitant targeting, which it links to the same attack, of several Schneider Electric pieces of equipment belonging to small hydroelectric installations in France, with moderate effects on the targeted equipment.”
“Following its investigation, C4 is able to attribute these destructive actions to the Shahid Kaveh cyber-offensive unit, affiliated with the electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran,” the agency said.
Polish cyberwarfare expert Lukasz Olejnik told ISMG on Tuesday that France’s decision to publicly attribute the attacks was not surprising.
“In this case, the attribution is understandable given the scale of the sabotage, impact on the population and the public concern,” he said. “Cyber operations attributable to a foreign state that cause physical damage on French territory constitute a violation of state sovereignty. So no wonder.”
“It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people,” French Foreign Minister Jean-Noël Barrot told reporters on Monday.
C4 outlined its evidence in a detailed report, saying that the Shahid Kaveh group – also known as CyberAveng3rs – had been observed in April using the Modbus industrial communication protocol on port 502 to “carry out mass reconnaissance of Schneider Electric industrial control systems, including in France.”
On Oct. 11 and 12, during the supermarket attacks, someone using the same technique conducted reconnaissance on Schneider Electric equipment at small and midsized energy and water production facilities. The attackers used the same infrastructure to target the supermarket cooling units.
C4 said the supermarket attacks involved the use of the FOFA scanning tool, consistent with known Iranian techniques. Investigators also found traces of Farsi in the attack infrastructure. The report said the supermarket attacks had been publicized on the Shahid Kaveh-linked propaganda website CyberbanNews on Oct. 13.
This is not the first time the Islamic Revolutionary Guard Corps, or IRGC, has targeted France through cyber operations. The European Union earlier this year sanctioned Iranian firm Emennet Pasargad – apparently a front for the IRGC’s Shahid Shoostari unit – for hacking French satirical magazine Charlie Hebdo in 2020 and 2023 and attempting to take over video display screens at the 2024 Paris Olympics (see: EU Belatedly Sanctions Chinese and Iranian Hackers).
Iran may now be targeting France – and potentially other European countries whose supermarkets were attacked – over perceived support for the U.S.-Israeli bombing campaign in Iran.
The Iranian government has repeatedly warned that any country aiding the strikes would be a legitimate target. The French government has opposed the U.S.-Israeli campaign, but it allowed the U.S. Air Force to temporarily use its Istres air base for noncombat operational support.
Responding to France’s attribution of the supermarket attacks, U.S. Secretary of State Marco Rubio said the attackers were “sickos” and that “France is not even involved” in the Iran war. “The news today doesn’t surprise us,” he said. “[The IRGC has] done things like this for a very long time.”
U.S. cybersecurity authorities warned in April that Iran was actively targeting internet-connected operational technology devices, including programmable logic controllers, or PLCs. The authorities said the attacks had disrupted “PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface and supervisory control and data acquisition displays, resulting in operational disruption and financial loss.”
Just last week, CISA issued an alert to the U.S. healthcare sector, warning providers to urgently strengthen protections for internet-connected refrigeration systems used to preserve blood supplies and medication.
CISA and several international counterparts reported in late 2023 that CyberAveng3rs had targeted and compromised PLCs made by Israeli company Unitronics used in water systems and other sectors in the U.S. and elsewhere.
The Paris Public Prosecutor’s Office is investigating the October cyberattacks and has requested international arrest warrants against “several members” of Shahid Kaveh, the French government said in its Monday statement. The C4 report identified the unit’s commanders as Mahdi Lashgarian and Reza Salarvand. It also named Hamid Reza Lashgarian as the head of the IRGC’s cyber command.
The French government summoned Iran’s ambassador Tuesday morning. According to Politico, EU foreign affairs chief Kaja Kallas said Europe’s foreign ministers would discuss France’s attribution of the attacks at a meeting next week. She said that if the attribution is confirmed, the “response should be strong.”