France Blames Iran’s Revolutionary Guards for Supermarket Freezer Hack
French Foreign Minister Jean-Noël Barrot said Iran's Revolutionary Guards were responsible for October hacks that pushed supermarket freezer temperatures above 50C. He promised Europe-wide sanctions. Paris prosecutors opened a criminal investigation. Iran has not responded.
French Foreign Minister Jean-Noël Barrot said Iran's Revolutionary Guards were responsible for the October cyber-attack on French supermarket freezers, and he promised sanctions across Europe. The hackers pushed temperatures in cold units above 50C in as many as 700 shops.
Barrot spoke at a press briefing during the G7 summit in Paris. He called the attack one of "unprecedented scale and unprecedented aggression" and "a major violation of the nation's interests."
"I am able to confirm that the Islamic Republic of Iran's Revolutionary Guards are responsible for this attack," he said. France has summoned the Iranian ambassador to protest. Iran has not yet responded to the allegations.
What the hackers did
On October 11 and 12, attackers remotely overrode the temperature settings on thousands of freezers, fridges and chiller cabinets. Readings went from as low as -27C to well over 50C in some cases.
Thousands of tons of food were dumped. In some stores the heat set off fires, which triggered sprinklers and caused water damage.
The attack targeted software from Danish engineering firm Danfoss that lets retailers manage cold units remotely. More than 100 Coopérative U supermarkets were hit, along with 180 stores from Intermarché and its Netto brand. Carrefour, Monoprix and E.Leclerc were also affected.
Prosecutors name a hacking unit
Paris public prosecutor Laure Beccuau said investigators had identified a modus operandi typical of Shahid Kaveh, a cyber warfare unit linked to the Islamic Revolutionary Guards Corps. She cited the use of Farsi and IP addresses traced to devices in Iran.
Her office has opened an investigation into the unit's head, his deputies and others yet to be identified. The charges include fraudulent attacks on an automated data processing system by an organized crime ring, and causing damage dangerous to people. She said the offenses were aggravated because they served a foreign power.
Gérôme Billois, a partner at cybersecurity firm Wavestone, said Shahid Kaveh has been active since 2020. He said it was known mainly for attacks on US water distribution systems.
"For the moment they are attacking easy equipment," Billois said. "We should be prepared to see attacks on other systems like water or electricity."
Further incidents
Similar problems followed. Retailers in 11 European countries, including the UK, Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, reported refrigeration faults last week.
Hackers also accessed control systems at cold stores holding blood products in France. The French blood service said alarms let technicians disconnect the units before any products were destroyed. It is not clear whether the attacks are linked.
A regional branch of Crédit Mutuel bank separately reported losing more than €100m in a cyber-attack on Friday. The bank said it had recovered some of the money.
The French government has not said how it concluded Iran was responsible. The European Commission did not immediately comment on Barrot's statement.
