France blames Iranian cyber unit for supermarket refrigeration sabotage

France's Ministry for Europe and Foreign Affairs said on Monday that Iran carried out an October cyberattack against French supermarket refrigeration, and it blamed Shahid Kaveh, a cyber-offensive unit of the Islamic Revolutionary Guard Corps' electronic and cyber center. Foreign Minister Jean-Noël Barrot called the operation an act of "unprecedented scale and unprecedented aggression" and said "Europe-wide sanctions" would be imposed against those responsible. The French government has summoned Iran's ambassador and plans to ask the EU to sanction Iranian people and groups tied to malicious cyber activity. Reuters reported on Monday, quoting two people it did not name, that French officials believed state-backed Iranian hackers were responsible; the news agency could not verify the reasoning behind that assessment.

The attack occurred overnight on 11–12 October, and the intruders broke into industrial refrigeration controllers and changed the defrost settings to higher temperatures remotely. About 700 retail locations were hit, according to French authorities, causing at least 15 fires and food losses worth tens of millions of euros. The Guardian reported that hackers overrode the temperature settings on thousands of freezers and chiller cabinets, raising temperatures from as low as -27C to over 50C in some cases; thousands of tonnes of food were discarded in some incidents, and some fires set off sprinklers and caused water damage.

A technical report from France's CERT-FR says the chains Leclerc, Casino, Coopérative U, Carrefour, Metro and Intermarché were hit, as were independent butcher shops, one slaughterhouse and cooperative food processors. During the same period, investigators also found attacks on Schneider Electric industrial equipment at small hydroelectric sites and tied them to the same operation, though the effects were moderate.

Paris public prosecutor Laure Beccuau said investigators had identified "a modus operandi" typical of Shahid Kaveh, including "the use of Farsi and IP addresses traced back to devices located in Iran". Her office has opened a judicial investigation and wants international arrest warrants for the unit's alleged leader and two deputies, KDBC reported. France's Cyber Crisis Coordination Center, called C4, blamed the attacks on Shahid Kaveh, and CERT-FR says the unit uses online hacktivist personas such as CyberAveng3rs, Soldiers of Solomon, Mr. Soul and the Cyber Isnaad Front. French investigators say the attackers' infrastructure was also used to scout Schneider Electric systems with methods previously linked to the unit, the FOFA search engine was employed, the CyberbanNews outlet connected to Shahid Kaveh publicized the attacks on 13 October, and Farsi-language traces were found in the infrastructure.

France has tied only the October attacks on French supermarkets to Iran, not the later incidents. A second wave of refrigeration system attacks was reported in November, hitting more than 115 stores in six European countries, and France's national blood service said temperature and defrost settings had been changed at three blood storage facilities. The Guardian reported similar incidents in other European countries the previous week and at a French blood bank, and said it was unclear whether the supermarket and blood bank attacks were connected. Gérôme Billois, a partner at Wavestone, said Shahid Kaveh had operated since 2020 and had mostly attacked water distribution systems in the US; since both the supermarket and blood bank incidents involved freezers, he said, "it is reasonable to think Iran is directly linked to both".

The FBI and CISA warned last week about ongoing cyberattacks aimed at industrial refrigeration and cold-chain monitoring systems around the world.