“A terrorist organisation has committed an attack of unprecedented scale and aggression against our country,” said Jean Noel Barrot, French Foreign Minister.
France formally blamed Shahid Kaveh, a unit operating under Iran’s Islamic Revolutionary Guard Corps Cyber Electronic Command, for a hacking operation in October that impacted about 700 French supermarkets, as reported by the Foundation for Defense of Democracies.
The attacks also struck butcher shops, a slaughterhouse, cooperative food plants, and Schneider Electric equipment at hydroelectric plants, representing what French authorities termed the first offensive cyber campaign carried out purely for the purposes of sabotage on French soil.
While Iran was once viewed as a less sophisticated cyber actor compared to nations like China, Russia, and North Korea, security officials warn that Tehran is rapidly shifting from espionage and data theft to destructive operations against operational technology systems.
The operation mirrors previous tactics deployed by groups linked to the Iranian military. The malware and tooling used in the French attacks closely resemble those deployed by CyberAv3ngers, an Iranian hacking front group best known for attacking U.S. water utilities in November 2023, according to advisories issued by the U.S. Cybersecurity and Infrastructure Security Agency.
The campaign has targeted physical infrastructure across multiple continents, including water stations in the American Midwest where operators were locked out of control systems across seven U.S. states. Concurrently, energy tankers suffered network breaches while crossing the Atlantic, and refrigerators at grocery stores across Europe were remotely pushed to higher temperatures, spoiling food supplies and sparking fires.
In Belgium, political leaders divided over attribution. “There was enough evidence from our security services for me to say that Iran is very likely behind the cyberattacks we have seen targeting our shops,” Bernard Quintin, Belgian Interior Minister, told VRT NWS.
However, Maxime Prévot, Belgian Foreign Minister, adopted a more cautious stance in a separate statement, noting that available information remained insufficient to officially hold Iran responsible and that the federal prosecutor’s office was still investigating.
Iran has consistently denied involvement in malicious cyber operations abroad. Mohammad Amin-Nejad, Iran’s ambassador to France, told The Wall Street Journal that if Tehran possessed such capabilities, it would not deploy them against European countries, suggesting instead that the U.S. or Israel might be responsible or that another nation was at fault.
| Incident Date | Target Sector | Location | Attribution / Suspected Actor |
|---|---|---|---|
| November 2023 | Water Management Facilities | United States (Midwest / 7 States) | CyberAv3ngers / Shahid Kaveh |
| September 2026 | Energy Tankers | Atlantic Ocean (En route to Texas) | Under Investigation (Iran-linked) |
| October 2026 | Supermarkets & Cold Storage | France (approx. 700 sites) | Shahid Kaveh (IRGC-CEC) |
| November 2026 | Grocery Refrigeration Units | Belgium & Sweden | Belgian Interior Minister cites Iran |
The operational mechanism behind these incidents relies on compromising programmable logic controllers, which automate industrial processes across sectors ranging from water treatment to commercial refrigeration. Because conventional cold-chain infrastructure can take hours to recover after a temperature failure, remote interference can rapidly destroy perishable inventories.
“The information currently available to us is insufficient to officially hold Iran responsible,” Maxime Prévot, Belgian Foreign Minister, said in a statement.
