France Blames Iran-Linked Hackers for Attack on Supermarket Refrigeration
French Foreign Minister Jean-Noël Barrot said on Monday that Iran's Revolutionary Guards were behind the October cyberattack that overheated refrigeration units in hundreds of supermarkets. Paris will seek European sanctions, and prosecutors want arrest warrants for three suspected members of a Guards-linked cyber unit.
France blames Iran-linked hackers for an October cyberattack that overheated refrigeration systems in hundreds of supermarkets. Foreign Minister Jean-Noël Barrot said on Monday, November 9, that the Islamic Revolutionary Guard Corps (IRGC), Iran's elite military branch, carried out the attack. He vowed sanctions at European level.
"This attack is unprecedented in both its scale and its level of aggression," Barrot said. He added that France would "implement sanctions at the European level against all those responsible."
Iran has not responded publicly. Its mission to the United Nations did not return messages seeking comment, and Iran routinely denies carrying out malicious cyber operations.
What the hackers did
The attack hit overnight on October 11-12. Hackers took control of software that regulates the temperature of refrigeration units, which retailers use to manage cold storage remotely. The software is supplied by Danish engineering firm Danfoss.
Around 700 of France's roughly 10,000 supermarkets were affected, according to estimates. More than 100 Coopérative U stores were hit, along with 180 Intermarché and Netto outlets. Carrefour, Monoprix and E.Leclerc also reported problems.
Food worth millions of euros spoiled. In some stores temperatures reportedly climbed to 50C (120F) overnight, and some units caught fire.
Barrot called it "the first large-scale cyberattack aimed at sabotage on our national territory." He said the government had summoned the Iranian ambassador in Paris to lodge a "very strong protest."
Prosecutors name a unit
Paris prosecutor Laure Beccuau said a judicial investigation has been opened into the head of Shahid Kaveh, an offensive cyber unit affiliated with the IRGC's Electronic and Cyber Center. The probe also covers his two deputies and any other people who may be identified.
Prosecutors are seeking international arrest warrants for the three. They cited Farsi-language activity and IP addresses traced to Iran as evidence.
The French government has not said how it reached its conclusion. Attributing cyberattacks is notoriously hard, because hackers can disguise their locations.
A second wave across Europe
Earlier this month, a second wave of hacks hit more than 100 stores across Europe. Shops in Belgium and Luxembourg were affected, as were a smaller number in Sweden, Ireland, the Netherlands, Estonia and Finland. Refrigerators used by French blood banks were also targeted, and staff moved some blood to other cold storage.
It is not known whether those incidents are linked to the October attack. Two Russian-aligned hacktivist groups claimed responsibility last Wednesday, but few observers believed them.
Barrot said France would take "any other necessary and proportionate measures" to "deter anyone who might seek to repeat it."
