Casino

Summary

French authorities attributed a cyberattack campaign targeting hundreds of supermarkets across France to two units of Iran's Islamic Revolutionary Guard Corps operating through front groups posing as vigilante hackers. The intrusion altered refrigeration defrosting parameters to raise temperatures, resulting in substantial merchandise losses, at least fifteen fires, and disruptions at blood banks that required relocating stored blood. Retailers including Casino were among the affected organizations, and a subsequent wave struck more than one hundred establishments across Europe. Prosecutors issued international arrest warrants for three Iranian officials linked to the Electronic and Cyber Center, while Iran denied the allegations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

French authorities reported that hundreds of refrigerators shut down across grocery stores in France last month, with systems compromised overnight between Sunday, October 11 and Monday, October 12, 2026. The attackers changed the equipment's defrosting parameters to set high temperatures, which caused significant merchandise losses and at least 15 fires. The affected organizations were mostly in retail and included the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups. France's Cyber Crisis Coordination Centre described the attack as unprecedented in scale and aggressiveness. The disruption left refrigerators empty in multiple supermarket chains, with images showing bare frozen food aisles and fresh-food sections in Paris and western France on October 12 and 13. Employees were seen filling boxes of perished goods outside an Intermarche supermarket in Paris the day after the attack. A second wave of attacks hit more than 100 establishments across Europe later that month, extending the impact to refrigerators at French blood banks where staff had to move blood to other cold storage units.

French officials squarely blamed the operation on two units of Iran's Islamic Revolutionary Guard Corps, identified as Shahid Kaveh and Shahid Shoostari, which operated through front groups posing as vigilante hackers including CyberAveng3rs and Cyber Isnaad Front. Paris chief prosecutor Laure Beccuau announced that her office had issued international arrest warrants for three Iranians affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guards Corps. The individuals named were Hamid Reza Lashgarian, leader of the IRGC's Electronic and Cyber Center, and Mahdi Lashgarian and Reza Salarvand, identified as commanders of the Shahid Kaveh unit. Iran's Foreign Ministry responded by calling the accusations baseless and biased, accusing France of projecting its own governance failures and being unable to control refrigerator temperatures. French cyber authorities stated that the attacks fit a pattern of operations by the same unit dating back to at least 2020, including a cyberattack on the satirical magazine Charlie Hebdo in 2023 and one on a French video display company in 2024 during preparations for the Paris Olympic and Paralympic Games. Since the Iran war began in February 2026, security officials have also blamed Iranian hackers for hacks on US water treatment plants in July and on US-bound oil tankers in August.

Sources

Sources available to members: 1 source.