Iran Behind France Grocery Fridge Hacks, Paris Says; Tehran Denies
Paris prosecutors say Iran's Revolutionary Guard cyber unit hacked refrigeration systems at about 700 French retail sites on October 11. France is summoning Iran's ambassador and seeking European sanctions, while Tehran calls the accusation baseless and hostile.
French authorities said on Monday, November 9, that Iran was behind the October cyberattacks that overheated refrigeration units at hundreds of French grocery stores. Iran's foreign ministry has rejected the charge as "baseless and hostile." Paris is now pushing for European sanctions.
The Paris prosecutor's office blamed a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the elite branch of its armed forces. It said the October 11 attack hit "700 retail locations across France."
The result was "significant food spoilage" and roughly twenty fires as temperatures in the units shot up, according to the prosecutor's office.
How the attack worked
Attackers took remote control of the equipment through web interfaces, prosecutors said. They triggered abnormal defrost cycles and switched off the alerts that warn when temperatures climb too high.
Investigators cited the use of Farsi and IP addresses tracing back to devices in Iran. Hackers hit software supplied by Danish engineering firm Danfoss, which lets retailers manage cold units remotely. In some stores, fridge temperatures reportedly reached 50C (120F) overnight.
More than 100 Coopérative U supermarkets were affected, along with 180 Intermarché and Netto stores. Carrefour, Monoprix and E.Leclerc were also hit.
Investigation and French response
A judicial investigation targets the head of the Iranian group Shahid Kaveh, his two deputies and anyone else identified. The prosecutor's office described the group as affiliated with the IRGC's Electronic and Cyber Center. It is also requesting international arrest warrants.
French Foreign Minister Jean-Noël Barrot called the campaign "unprecedented in both its scale and its level of aggression." He said France would summon the Iranian ambassador and call for European sanctions. France "rules nothing out" and "will not stop at merely" those measures, he told broadcaster Franceinfo.
France's national cybersecurity agency, ANSSI, said the hackers also targeted several small hydroelectric plants, with "moderate effects."
Wider wave of attacks
Similar hacks later hit supermarkets in Belgium, Luxembourg and Sweden, and smaller numbers of shops in countries including Ireland, the Netherlands, Estonia and Finland. A separate cyberattack targeted several French blood banks, but no products or samples were damaged.
In August, refrigeration outages at six US military bases led to an ongoing investigation by the US Army's Criminal Investigation Division. No official in France, the US or the other affected countries has said all of these incidents are connected.
The French government has not said how it reached its conclusion on Iran. Attribution of cyberattacks is notoriously difficult because hackers can disguise their locations. Two Russian-aligned hacktivist groups claimed responsibility last week, but few experts believed them.
The FBI's cybercrime branch warned last week of malicious activity targeting industrial refrigeration and cold-chain monitoring systems worldwide. Weaknesses in unpatched or internet-accessible controllers, it said, can let attackers change settings and cause inventory loss and equipment damage.
