France blames Iran's Revolutionary Guards for 700-store sabotage and says they probed Schneider Electric gear
The same French report says the attackers' infrastructure was probing Schneider Electric equipment at energy and water sites. For holders of the biggest listed industrial-control vendor, that is event risk on the installed base, and the week's price action does not reflect it.
Vincent Jiangthree-minute read
Freezers turned into weapons
Overnight on October 11–12, intruders took remote control of refrigeration controllers at about 700 French food sites 57. The victims named by France's CERT-FR include Carrefour, Leclerc, Casino, Intermarché, Coopérative U and Metro, plus butchers, a slaughterhouse and food cooperatives 57. The attackers started defrost cycles with no time limit and switched off the high-temperature alarms, pushing cabinets to 50°C 57.
The joint report by France's cyber crisis center C4 counts at least 15 fires 17; the Paris prosecutor's office puts the figure near 20 5. Food losses run to tens of millions of euros 1. On November 2 the same style of intrusion reached three blood-storage sites; staff moved the stock before anything spoiled 2.
France names the unit
On November 9, foreign minister Jean-Noël Barrot told a G7 briefing in Paris that Shahid Kaveh, an offensive cyber unit of Iran's Revolutionary Guards, was responsible 16. Prosecutors opened a judicial investigation and requested international arrest warrants for the unit's head and two deputies; the report names Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand 26. France summoned Iran's ambassador on November 10 and is proposing EU sanctions 17. US agencies had already tied the same unit, under its CyberAv3ngers persona, to the 2023 attacks on American water utilities 67.
Schneider Electric is in the report
The controllers that burned were Danfoss and Dixell, not Schneider 5. But the C4 report says the infrastructure used against the supermarkets was also probing Schneider Electric+0.95% — Schneider Electric, up 0.95 percent today equipment at small and medium energy and water sites, over the Modbus industrial protocol on port 502, using techniques linked to the unit since at least April 2026 15.
The cyber agency ANSSI tied the campaign to simultaneous intrusions on Schneider equipment at several small hydroelectric plants, with moderate effects 57. The report adds that since June 2024 the unit has had the ability to scan, access and control kit from Schneider, Siemens and Rockwell 7. None of the coverage carries a statement from Schneider.
What the market has priced
Schneider shares rose 6.26% over the seven days to November 12, against a 19.53% fall over three months 4. That slide follows the €6 billion share issue of October 20 and the €6 billion bond of October 29 that fund the PTC acquisition, not the sabotage 4. The share price is carrying the financing; nothing in it carries a French state report putting the company's field gear in a state actor's scope.
Schneider's week-long rebound is small change against its three-month slide
The rebound is a fraction of the PTC-financing slide; the Iran story is not in this chart
Data
| Schneider Electric | |
|---|---|
| One session | 1.46% |
| Seven days | 6.26% |
| Three months | -19.53% |
What would make this a Schneider story, not a food story
Three things decide whether this stays a food story. Whether the EU adopts the sanctions France is proposing 7. Whether France attributes the November wave that has hit stores across Europe and the blood service, which it has so far left unattributed 68. And whether Schneider addresses a report that names its equipment, as the FBI and CISA warn cold-chain operators worldwide 8. A state has now shown it will burn food through a web interface, and the same reconnaissance ran against the equipment that keeps water and power running.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
