France blames Iran's Revolutionary Guards for supermarket fridge cyberattacks

France has accused a cyber unit linked to Iran's Islamic Revolutionary Guard Corps (IRGC) of carrying out attacks on commercial refrigeration systems that disrupted hundreds of businesses, damaged equipment and caused substantial food losses.

French Foreign Minister Jean-Noël Barrot announced on Monday (November 9) that Iran's ambassador had been summoned to the Foreign Ministry over the incidents. He also indicated that Tehran could face additional European Union sanctions.

The announcement followed a Reuters investigation revealing that French officials privately suspected Iranian state-backed hackers of involvement in the attacks.

The incidents affected supermarkets and other food businesses across France in October, with investigators reporting hundreds of affected locations and fires caused by refrigeration equipment overheating.

French investigators identify suspected Iranian cyber unit

A joint report by French intelligence and cybersecurity agencies attributed the attacks to Shahid Kaveh, which they identified as an offensive cyber unit associated with Iran's Revolutionary Guards.

The report also named three alleged associates: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.

According to French investigators, the attackers operated through several groups presenting themselves as independent hackers, including CyberAveng3rs and Cyber Isnaad Front.

The agencies based their findings on similarities between the refrigeration attacks and earlier operations attributed to Shahid Kaveh.

Investigators also identified connections between the digital infrastructure used in the incidents and systems previously associated with the group, along with traces of the Farsi language in the attack infrastructure.

French prosecutors have requested international arrest warrants for those responsible.

Reuters reported that it had been unable to obtain contact information for the three individuals named in the French findings.

Iran's mission to the United Nations did not respond to requests for comment. Tehran has consistently rejected allegations that it conducts malicious cyber operations.

Cyberattacks affect 700 commercial sites

The French authorities reported that approximately 700 commercial sites were targeted in the October hacking campaign.

Most were supermarkets, although the attacks also extended to smaller butcher's shops, a slaughterhouse and food-processing facilities.

The disruption was particularly severe on October 11, when hackers reportedly manipulated refrigeration temperatures remotely, causing food to spoil and equipment to overheat.

French investigators identified at least 15 fires associated with the attacks.

Supermarket workers were forced to dispose of large quantities of spoiled meat, ice cream and other temperature-sensitive products after refrigeration systems stopped functioning properly.

One French supermarket owner estimated that the combined damage across the country could reach tens of millions of euros.

Microsoft had privately associated the October refrigeration attacks with Iran more than two weeks before the French government's announcement, according to three people familiar with the matter.

The technology company declined to comment on the findings.

Further attacks reported across Europe

The October incidents were followed by another wave of refrigeration-related cyberattacks in early November, affecting more than 100 establishments across Europe.

French blood banks were also among the organisations affected, forcing staff to transfer some blood supplies to alternative cold-storage facilities.

However, the extent to which the various attacks were connected has not been independently established.

The incidents have highlighted concerns about the vulnerability of commercial refrigeration equipment, particularly systems that can be accessed remotely.

Cybersecurity specialists previously consulted by Reuters indicated that some attacks may have exploited relatively straightforward security weaknesses rather than advanced hacking techniques.

A company supplying equipment to affected businesses acknowledged that several refrigeration units were obsolete or used outdated firmware, potentially leaving them vulnerable to unauthorised access.

Saher Naumaan, a senior threat researcher at cybersecurity company Proofpoint, suggested that the attacks demonstrated weaknesses in the targeted systems more than the sophistication of the hackers.

US military refrigeration incidents under investigation

Similar refrigeration failures were reported at US military facilities before the attacks in France.

In August, refrigeration equipment stopped working at six or more military commissaries, prompting an investigation into whether the failures resulted from cyberattacks.

A person familiar with the investigation told Reuters that the Pentagon considered Iran a possible suspect, although the inquiry remained ongoing.

Reuters could not establish how US military investigators reached that assessment or whether other potential suspects were being examined.

The Pentagon acknowledged reports of a possible cyber incident but declined to provide further details, citing security considerations.

The refrigeration attacks have emerged amid the war involving Iran, which began in February and has been accompanied by several suspected cyber operations.

Other reported incidents have included attacks affecting Los Angeles transport systems in March, US water treatment facilities in July and ships travelling towards the United States in August.

French authorities have indicated that they intend to pursue accountability for the refrigeration attacks, while cybersecurity specialists continue examining how commercial systems can be better protected against similar disruptions.

Source: Reuters