Iran-linked threat group Shahid Kaveh conducted coordinated attacks on operational technology infrastructure serving more than 700 French supermarkets, destroying industrial refrigeration control systems. A blood bank was also targeted. France is pursuing international arrest warrants for IRGC-linked leaders in connection with the attack.
What happened
Shahid Kaveh, described by French authorities as IRGC-linked, conducted coordinated attacks that destroyed industrial refrigeration OT equipment across more than 700 French supermarkets simultaneously. The refrigeration systems maintain food safety temperatures across store cold chains. When controllers are physically destroyed rather than encrypted or disrupted, the equipment requires physical replacement before operations can resume.
French authorities are pursuing international arrest warrants for individuals with IRGC connections. The incident is described as the first large-scale territorial cyberattack on France, meaning an attack specifically targeting French soil rather than French interests abroad.
Why food and cold-chain OT is a high-value target
Industrial refrigeration is a soft target in the OT landscape. Unlike power grid or water treatment infrastructure, food and cold-chain logistics OT often lacks the same level of regulatory scrutiny and network monitoring. Many industrial refrigeration systems run on legacy controllers purchased for reliability and cost, not security.
The calculus for a state-linked actor is straightforward: disrupting hundreds of supermarkets simultaneously creates civilian hardship, media coverage, and political pressure, all without triggering the same escalation thresholds as attacking a power grid. Blood banks add a humanitarian dimension that amplifies the political message.
Immediate actions for OT operators
- Audit your network architecture. Determine whether your industrial control systems, including refrigeration, HVAC, and building management systems, are isolated from your corporate IT network and from the internet. Network segmentation is the most effective control for limiting the blast radius of an OT compromise.
- Identify and eliminate unnecessary remote access. Every internet-facing OT management console is an entry point. Remote access was the most likely initial vector in this operation.
- Check your physical restoration plan. If OT equipment is physically destroyed rather than encrypted or disrupted, can you restore operations? Maintain spare controllers in inventory. After a large-scale coordinated attack, supply chains for replacement OT equipment can also be disrupted.
- Engage your ISAC. The Food and Agriculture ISAC and the Healthcare ISAC both track threats relevant to this type of infrastructure. Membership provides early warning on campaigns targeting your sector.
State-sponsored OT sabotage is becoming normalized
The Shahid Kaveh attack is not an isolated incident. Iran has previously targeted industrial infrastructure in Israel, Saudi Arabia, and the United States. The novelty here is the geographic target and the scale of simultaneous impact across hundreds of sites.
The techniques that worked against industrial refrigeration in France can be applied to pharmaceutical cold storage, hospital HVAC, water treatment, and food processing. OT network segmentation, elimination of unnecessary remote access, and a physical restoration capability for critical systems are the three controls that would most limit impact from an attack like this one.
Written by Gigia Tsiklauri, Security Architect and AI Security specialist at Infosec.ge.