Paris names the IRGC-linked Shahid Kaveh unit, summons Iran’s ambassador and seeks EU sanctions
France blamed Iran’s Revolutionary Guards on 9 November 2026 for the fridge hacks across supermarkets and blood banks. Iran has not responded. TF could not read the Guardian or BBC reports. The summary draws on Al Jazeera, TechCrunch and The Standard, which carries Reuters reporting.
What’s Happening & Why It Matters
Barrot Names the Revolutionary Guards
French Foreign Minister Jean-Noël Barrot told reporters in Paris on Monday he could confirm the IRGC bore responsibility. France summoned Iran’s ambassador and will seek sanctions at EU level. Barrot said French justice holds the case and the hackers will face consequences.
Paris prosecutors requested international arrest warrants for Shahid Kaveh’s leader. The offensive cyber unit is linked to the Guards. Al Jazeera counts two deputies. The Standard names three associates. TF has not named the individuals.
Al Jazeera reports the French foreign ministry gave no details on the evidence in its statement. Iran’s UN mission and its New York consulate did not respond to requests for comment.
My take: An official attribution with arrest warrants is a high bar. Barrot gave little technical detail on Monday.
What the French Report Says
A joint report from French intelligence and cyber agencies tied the attacks to Shahid Kaveh, according to The Standard. Investigators cite three links: the digital infrastructure used, the intrusion pattern and Farsi-language traces. The group posed as vigilante hackers, per the report, under the names “CyberAveng3rs” and “Cyber Isnaad Front.”
The report counts 700 commercial sites attacked in France, with at least 15 fires. Supermarkets formed most of the total. Butcher shops, a slaughterhouse, and food-processing plants also suffered attacks. A second wave reached more than 100 sites across Europe, including blood-bank refrigerators.
The French Blood Establishment said it stopped the blood-bank attacks before any blood spoiled, per TechCrunch. TF covered the blood-bank attacks and the second wave earlier.
My take: The scale is large, and the fire count shows physical danger. The Farsi traces are weak evidence, because attackers can plant language clues.
Microsoft, the Pentagon and Weak Controllers
Reuters reported Microsoft had tied Iran to the October attacks at least two weeks earlier, citing three people familiar. Microsoft declined to comment. Reuters reported the Pentagon treats failures at US military commissaries as a suspected cyberattack, with Iran a suspect.
The Pentagon said it was aware of speculation about a cyber incident and gave no more detail. TechCrunch reports the US government linked pro-Iranian hacktivists to the attacks. US intelligence has made no public attribution.
Many controllers were old. Some Danfoss models no longer receive security fixes, per TechCrunch. Saher Naumaan of Proofpoint said the sabotage shows how exposed such systems are, rather than Iranian skill.
My take: Attribution and exposure are separate problems. Sanctions will not fix controllers left on the internet with default settings.
TF Summary: What’s Next
EU members will debate sanctions on the Shahid Kaveh unit and its officers. Retailers and blood services will audit refrigeration controllers. Iran will deny the charge, as it has in earlier cases.
MY FORECAST: The EU will list Shahid Kaveh members under its cyber sanctions regime before 31 March 2027. Danfoss will publish a patch or end-of-life notice for the affected models by mid-2027.
Related Stories You May Like:
- Hackers Target Supermarket Refrigeration in Europe: Second Wave
- Cooling Hacks Target French Blood Banks
- TF Cybercrime Round-up: 06-08 November 2026
- TF Cybercrime Round-up: 03-04 November 2026
- Nvidia Stock Falls as Board Opens Probe Into CEO Jensen Huang