The attribution, issued jointly with the national cybersecurity agency ANSSI, names a specific unit: Shahid Kaveh, which the French government links to the electronic and cyber centre of Iran’s Islamic Revolutionary Guard Corps. France’s Cyber Crisis Coordination Centre, which brings together ANSSI, military cyber command and intelligence services, reached the conclusion after a month-long investigation. The centre’s technical findings sit in a separate CERT-FR report, CERTFR-2026-CTI-009.

Foreign minister Jean-Noël Barrot called it “an attack of unprecedented scale and aggression” against France and said the government “will take whatever measures are necessary” in response. Those measures, according to the ministry’s statement, include summoning Iran’s ambassador, proposing new EU sanctions against the individuals and entities involved, and reserving the right to further public and non-public action. The Paris public prosecutor has opened a judicial investigation and is seeking international arrest warrants against members of the unit.

Iran has denied the allegation. State media quoted officials accusing Paris of shifting blame for its own security failures onto Tehran.

ANSSI’s public evidence is limited to four categories: characteristics of the attack infrastructure, tooling with an identifiable signature, amplification of the attack by a propaganda channel linked to Shahid Kaveh, and traces of Persian-language use inside the attackers’ infrastructure. The agency has previously said the French incidents did not run through a single disclosed vulnerability in one brand of controller, but through exposed administration interfaces and weak or default passwords on refrigeration systems made by Danfoss and Copeland, many of them reachable directly from the internet. Separate research from Check Point has linked Shahid Kaveh to CyberAv3ngers, the group behind intrusions into US water utility control systems in 2023 and 2024.

The French attribution covers one specific night, one specific country and roughly 700 specific sites. It does not, on its own, resolve the wider picture that has built up around it since. A second, larger wave of attacks on refrigeration systems hit businesses in at least 11 European countries at the start of November, reaching UK meat suppliers, a produce wholesaler and an equipment supplier tied to France’s national blood service. Separately, US officials have spent the past three months investigating freezer and cooling failures at roughly six military commissaries, a pattern that began in August and was first reported publicly in late October.

Washington’s response to that second thread came on 5 November, four days before France named Iran. CISA, the FBI and the US Departments of Health and Human Services, Agriculture and Transportation issued a joint advisory covering the entire category of industrial refrigeration and cold-chain monitoring, not just the military cases. CISA’s acting executive assistant director for cybersecurity, Chris Butera, said “every organization that depends on refrigeration and monitoring systems should assume it could be a target.” The FBI’s Brett Leatherman described the same pattern hitting critical infrastructure “globally.” Neither agency named a suspect. US officials have since said the commissary intrusions show traits consistent with Iranian cyber methods, but no US agency has formally tied those specific incidents to Shahid Kaveh, and the advisory itself draws no line to any government.

What connects the two announcements is not a shared piece of evidence but a shared cause. Shahid Kaveh’s French campaign, the UK and European retail wave, and the US commissary failures all ran, as far as the public record shows, through the same unremarkable weakness: refrigeration and cold-chain control systems that were connected to the internet, running factory-default or weak credentials, and never treated as part of anyone’s security perimeter. France’s attribution gives one slice of that campaign a named actor and a stated motive. It does nothing to patch a controller sitting on a loading dock somewhere else, still reachable from the open internet, still running the password it shipped with.

That is the detail worth carrying into any security review prompted by this story. Attribution closes a diplomatic and legal question. It does not close the vulnerability that made the attribution possible in the first place, and the hardening steps CISA and ANSSI have both published, taking controllers off the public internet, separating them from business networks, replacing default credentials and retiring unsupported hardware, apply whether or not a government ever puts a name to the next incident.

Register your interest for The Security Event 2027

Subscribe to The Security Briefing for monthly updates!