According to the ministry's statement, the attacks were carried out by Shahid Kaveh, an offensive cyber unit affiliated with the Revolutionary Guard's cyber center. Overnight on October 11–12, the attackers remotely changed defrost settings on industrial refrigeration controllers to high temperatures. Initial reports put the number of affected supermarkets at 250–350; authorities now say about 700 retail locations were targeted.
According to a CERT-FR technical report, affected companies include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as butcher shops, a slaughterhouse and food-processing facilities. Investigators also linked attacks on Schneider Electric equipment at small hydroelectric installations to the same campaign, with moderate effects. A second wave in November hit more than 115 stores in six European countries, and last week the FBI and CISA warned of attacks on refrigeration and cold-chain systems worldwide.
France said it will summon Iran's ambassador and propose new EU sanctions against Iranian individuals and organizations involved in cyberattacks. Organizations that run refrigeration or industrial control systems are advised to make sure controllers are not exposed to the internet, change default passwords and restrict remote access.