--- title: "France blames Iran's Revolutionary Guards for 700-store sabotage and says they probed Schneider Electric gear" description: "The same French report says the attackers' infrastructure was probing Schneider Electric equipment at energy and water sites. For holders of the biggest listed industrial-control vendor, that is event risk on the installed base, and the week's price action does not reflect it." publisher: "The Inference" section: "Security" published: 2026-11-12T18:11:30.903Z modified: 2026-11-12T18:11:30.903Z canonical: https://theinference.org/article/france-blames-iran-s-revolutionary-guards-for-700-store-sabotage-and-says-they-probed-schneider-electric-gear language: en keywords: "Cybersecurity, Iran, Schneider Electric, Critical Infrastructure, Industrial Control Systems" --- # France blames Iran's Revolutionary Guards for 700-store sabotage and says they probed Schneider Electric gear > The same French report says the attackers' infrastructure was probing Schneider Electric equipment at energy and water sites. For holders of the biggest listed industrial-control vendor, that is event risk on the installed base, and the week's price action does not reflect it. ## Freezers turned into weapons Overnight on October 11–12, intruders took remote control of refrigeration controllers at about 700 French food sites [5][7]. The victims named by France's CERT-FR include Carrefour, Leclerc, Casino, Intermarché, Coopérative U and Metro, plus butchers, a slaughterhouse and food cooperatives [5][7]. The attackers started defrost cycles with no time limit and switched off the high-temperature alarms, pushing cabinets to 50°C [5][7]. [The joint report by France's cyber crisis center C4](https://www.techspot.com/news/114506-france-iran-behind-supermarket-freezer-cyberattacks-caused-millions.html) counts at least 15 fires [1][7]; the Paris prosecutor's office puts the figure near 20 [5]. Food losses run to tens of millions of euros [1]. On November 2 the same style of intrusion reached three blood-storage sites; staff moved the stock before anything spoiled [2]. ## France names the unit On November 9, foreign minister Jean-Noël Barrot told a G7 briefing in Paris that Shahid Kaveh, an offensive cyber unit of Iran's Revolutionary Guards, was responsible [1][6]. Prosecutors opened a judicial investigation and requested international arrest warrants for the unit's head and two deputies; [the report names Hamid Reza Lashgarian](https://gizmodo.com/france-blames-iran-for-cyberattacks-that-sabotaged-700-grocery-stores-2000837163), Mahdi Lashgarian and Reza Salarvand [2][6]. France summoned Iran's ambassador on November 10 and is proposing EU sanctions [1][7]. US agencies had already tied the same unit, under its CyberAv3ngers persona, to the 2023 attacks on American water utilities [6][7]. ## Schneider Electric is in the report The controllers that burned were Danfoss and Dixell, not Schneider [5]. But [the C4 report says](https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html) the infrastructure used against the supermarkets was also probing [Schneider Electric](https://theinference.org/markets/companies/schneider-electric) equipment at small and medium energy and water sites, over the Modbus industrial protocol on port 502, using techniques linked to the unit since at least April 2026 [1][5]. The cyber agency ANSSI tied the campaign to simultaneous intrusions on Schneider equipment at several small hydroelectric plants, with moderate effects [5][7]. The report adds that since June 2024 the unit has had the ability to scan, access and control kit from Schneider, Siemens and Rockwell [7]. None of the coverage carries a statement from Schneider. ## What the market has priced Schneider shares rose 6.26% over the seven days to November 12, against a 19.53% fall over three months [4]. That slide follows [the €6 billion share issue of October 20](https://www.ideal-investisseur.fr/en/stock-news/schneider-electric-shares-in-the-lead-of-the-cac-40-up-6-5-in-one-week/29219.html) and the €6 billion bond of October 29 that fund [the PTC acquisition](https://theinference.org/article/schneider-committed-a-25-billion-bridge-to-buy-ptc-its-shareholders-pay), not the sabotage [4]. The share price is carrying the financing; nothing in it carries a French state report putting the company's field gear in a state actor's scope. *Chart: **Schneider's week-long rebound is small change against its three-month slide** Column chart of Schneider Electric share price change over three periods: one session up 1.46 percent, seven days up 6.26 percent, three months down 19.53 percent* *Percentage change in Schneider Electric shares, Euronext data, session of November 12, 2026; source Idéal Investisseur. [4]* ## What would make this a Schneider story, not a food story Three things decide whether this stays a food story. Whether the EU adopts the sanctions France is proposing [7]. Whether France attributes the November wave that has hit stores across Europe and the blood service, which it has so far left unattributed [6][8]. And whether Schneider addresses a report that names its equipment, as [the FBI and CISA warn cold-chain operators worldwide](https://www.bleepingcomputer.com/news/security/france-blames-iranian-hackers-for-supermarket-attacks-that-sparked-fires/) [8]. A state has now shown it will burn food through a web interface, and the same reconnaissance ran against the equipment that keeps water and power running. ## Takeaway France says an Iranian Revolutionary Guards unit turned the freezers of about 700 food sites into weapons, and that the same crew was probing Schneider Electric gear at water and power sites. Schneider's shares are carrying the PTC financing, not that report. ## Sources 1. [TechSpot, France says Iran was behind supermarket refrigerator cyberattacks, 2026-11-12](https://www.techspot.com/news/114506-france-iran-behind-supermarket-freezer-cyberattacks-caused-millions.html) 2. [Gizmodo, France Blames Iran for Cyberattacks That Sabotaged 700 Grocery Stores, 2026-11-09](https://gizmodo.com/france-blames-iran-for-cyberattacks-that-sabotaged-700-grocery-stores-2000837163) 4. [Idéal Investisseur, Schneider Electric shares in the lead of the CAC 40, up 6.5% in one week, 2026-11-12](https://www.ideal-investisseur.fr/en/stock-news/schneider-electric-shares-in-the-lead-of-the-cac-40-up-6-5-in-one-week/29219.html) 5. [The Hacker News, France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites, 2026-11-10](https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html) 6. [The Record (Recorded Future News), France blames Iran for fridge cyberattacks, says some caused fires, 2026-11-09](https://therecord.media/france-blames-iran-for-fridge-cyberattacks) 7. [The Register, France blames Iran for supermarket hack meltdowns, 2026-11-09](https://www.theregister.com/security/2026/11/09/france-blames-iran-for-supermarket-hack-meltdowns/5308591) 8. [BleepingComputer, France blames Iranian hackers for supermarket attacks that sparked fires, 2026-11-09](https://www.bleepingcomputer.com/news/security/france-blames-iranian-hackers-for-supermarket-attacks-that-sparked-fires/) --- France blames Iran's Revolutionary Guards for 700-store sabotage and says they probed Schneider Electric gear — The Inference. Canonical: https://theinference.org/article/france-blames-iran-s-revolutionary-guards-for-700-store-sabotage-and-says-they-probed-schneider-electric-gear