France links 700 supermarket refrigeration hacks to Iranian unit

France has formally attributed the October cyberattacks that sabotaged industrial refrigeration controllers across approximately 700 supermarkets and retail locations to an Iranian state-backed cyber unit, even as security researchers track thousands of internet-exposed operational technology devices across Europe and semiconductor equities retreat in Asia.

France Attributes October Cold-Chain Sabotage to IRGC Unit Shahid Kaveh

In a statement issued Monday, France's Ministry for Europe and Foreign Affairs and the Cyber Crisis Coordination Center (C4) — comprising cybersecurity agency ANSSI, military cyber command, and intelligence agencies — blamed the overnight Oct. 11–12 attacks on Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC), as reported by BleepingComputer. After initial estimates of 250 to 350 affected stores, French authorities disclosed that roughly 700 retail locations were hit, sparking at least 15 fires and causing tens of millions of euros in food losses and material damage.

According to a technical report from France's CERT-FR, the compromised refrigeration controllers affected Casino, Leclerc, Coopérative U, Metro, Carrefour, Intermarché, butcher shops, a slaughterhouse, and cooperative food-processing facilities, while France's national blood service reported altered temperature and defrost settings at 3 facilities storing blood products. Investigators also linked the campaign to reconnaissance and moderate disruptions targeting Schneider Electric industrial equipment at small hydroelectric installations, noting that Shahid Kaveh — which operates personas including CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front — used the FOFA device search platform, left Farsi-language traces, and publicized the operation on CyberbanNews on Oct. 13 following earlier March and April 2026 campaigns. France announced plans to summon Iran's ambassador and propose European Union sanctions.

Unit 42 Maps 5,000 Exposed Controllers Across Two Attack Waves

According to threat intelligence published by Unit 42, attackers raised targeted refrigeration units to temperatures as high as 50°C (122°F). Following the Oct. 11–12 wave in France, a second wave overnight between Nov. 1–2 expanded across at least 10 additional European countries, impacting 100 to 115 retail locations across 6 to 10 nations, with pro-Russian groups NoName057(16) and Z-Pentest making unverified claims on Telegram on Nov. 3 before CISA and the FBI issued advisories on Nov. 5. Using Cortex Xpanse between Nov. 5–6, Unit 42 identified over 5,000 internet-exposed devices from manufacturers named by CERT-FR, while documenting that exposed devices in France fell from 1,853 during Oct. 1–15 to 558 during Oct. 16–31 and 316 during Nov. 1–6.

Asian Semiconductor Stocks Tumble as Nasdaq Enters Correction

Simultaneously in global technology markets, Asian chip and technology shares tumbled Friday after an overnight Wall Street sell-off pushed the Nasdaq Composite into correction territory, with SK Hynix, Samsung, Softbank, and TSMC recording sharp declines, as reported by The Press.