The French government has formally accused Shahid Kaveh, an offensive cyber unit linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), of orchestrating a widespread cyberattack that disrupted supermarket refrigeration systems across France, spoiling millions of euros’ worth of food.
The attack, which took place between 11 October and 12, targeted cooling systems at around 700 commercial locations. Hackers remotely raised temperatures inside store refrigerators, causing food to spoil. French Foreign Minister Jean-Noel Barrot described the intrusion as “unprecedented in its level of aggression”, reports Al Jazeera.
According to a statement from the Paris prosecutor’s office, the attack was carried out by Shahid Kaveh under the IRGC’s Cyberelectronic Command (CEC).
A joint report by French intelligence and cybersecurity agencies identified three key figures behind the operation: Hamid Reza Lashgarian, head of the CEC, and Mahdi Lashgarian and Reza Salarvand, both commanders within the Shahid Kaveh unit. Hamid Reza Lashgarian and Mahdi Lashgarian had previously been sanctioned by the United States over their links to the IRGC’s cyber operations.
Tehran rejected the allegations on Tuesday, describing them as “baseless and biased”. Iran’s Foreign Ministry called the accusations a “highly irresponsible and contemptible action to tarnish Iran’s image and disrupt its relations with other countries”.
The ministry also warned that Tehran would take necessary measures to protect its national security and interests, but made no reference to the Shahid Kaveh group.
Front groups and covert operations
Although Iran’s government has never publicly acknowledged Shahid Kaveh, Western intelligence agencies consider it a key part of Tehran’s state-directed cyber operations.
The unit is believed to have been named after Mahmoud Kaveh, an IRGC commander who was killed at the age of 25 in 1986 during the Iran-Iraq War.
French intelligence agencies reported that Shahid Kaveh regularly operates through front groups posing as independent hacker collectives. These include CyberAveng3rs and Cyber Isnaad Front, which publicly claim responsibility for sabotage operations carried out by the unit.
Rising Iranian cyber capabilities
Defence and security analysts say Tehran has increasingly used cyber warfare to advance its geopolitical objectives.
Nikita Shah, a senior fellow with the Intelligence, National Security, and Technology programme at the Center for Strategic and International Studies (CSIS), pointed to a “notable uptick in Iran’s cyberoperations since March 2026”. These include cyber espionage and cybercrime linked to ongoing conflicts.
In an August CSIS analysis, Shah said Iranian cyber operators were likely preparing new technical access and capabilities to use if regional conflicts continued or diplomatic negotiations failed.
A 2025 policy report by the United Kingdom Parliament’s Intelligence and Security Committee also described Iran as an “aggressive cyberactor with extensive capabilities”.
Although Iran’s digital capabilities are considered less sophisticated than those of Russia and China, the committee noted that Tehran effectively exploits basic security weaknesses in target organisations, including those in the UK.
The report added that cyber operations give Iran a “deniable tool” to target adversaries, respond to perceived threats and project power both regionally and globally.
A pattern of targeting global infrastructure
The attack in France is part of a broader pattern of Iranian cyber operations targeting critical infrastructure worldwide. Previous campaigns linked to the IRGC and its affiliates have targeted facilities in the United States and Israel.
In late 2023, Iranian hackers targeted US water facilities using industrial computer systems manufactured by Israeli software company Unitronics.
Earlier this year, US security agencies warned that Iran-linked actors had breached industrial control systems across several critical infrastructure sectors. The attacks disrupted programmable logic controllers (PLCs) used to regulate machinery and manufacturing processes, causing operational disruptions and financial losses.
In March, an Iran-linked hacking group also claimed responsibility for a destructive cyberattack against Stryker, a US-based medical device manufacturer.
French intelligence officials said Shahid Kaveh and its associated proxy groups had mainly focused on US and Israeli targets, but their operations had also extended to France and other European countries.
