France has said Iran was responsible for a massive cyber-attack on supermarket freezers and chiller cabinets that was described by its foreign minister as being an act of “unprecedented scale and unprecedented aggression”.
Jean-Noël Barrot said “Europe-wide sanctions” would be imposed against those responsible, adding that the attacks – which took control of digital thermostats to push temperatures up to above 50C – constituted “a major violation of the nation’s interests”.
At a press briefing during the G7 summit in Paris, he said: “Thanks to the remarkable efforts of government agencies, I am able to confirm that the Islamic Republic of Iran’s Revolutionary Guards are responsible for this attack.”
He said the Iranian ambassador had been summoned “to protest in the strongest possible terms against this extremely serious act.”
Swathes of French supermarkets were hit in the cyber-attacks on 11 and 12 October. Some were forced to throw away entire inventories of perishable food.
Similar incidents have been reported since, including on supermarket fridges in other European countries last week and on a French blood bank.
The Paris public prosecutor, Laure Beccuau, said on Monday that specialist investigators and government agencies had identified “a modus operandi” characteristic of the Iranian group Shahid Kaveh, a cyber warfare unit linked to the Islamic Revolutionary Guards Corps (IRGC).
This included “the use of Farsi and IP addresses traced back to devices located in Iran”, she said.
Beccuau said her office had opened a investigation against the head of Shahid Kaveh, his deputies and “others who will be identified” on charges of “fraudulent attacks on an automated data processing system committed as part of an organised crime ring and of causing damage dangerous to persons”.
She said the offences were “aggravated by the fact they were committed to serve a foreign power – in this case Iran”.
Gérôme Billois, a partner at the cybersecurity and technology company Wavestone, said Shahid Kaveh had been active since 2020 and was known to have carried out cyber-attacks mostly on water distribution systems in the US.
“Two countries are known for this kind of attack: Iran and Russia. Given that recent cyber-attacks on supermarkets and the blood bank in France concerned freezers it is reasonable to think Iran is directly linked to both,” he said,
“For the moment they are attacking easy equipment but as a state group that has the means, the determination and the time, we should be prepared to see attacks on other systems like water or electricity.”
During the attack last month, hackers remotely overrode the temperature setting on thousands of freezers, fridges and chiller cabinets in as many as 700 supermarkets and shops across France, pushing them from as low as -27C (-16.6F) to well over 50C (122F) in some cases.
Thousands of tons of food had to be dumped and in some stores the extreme temperature rise sparked fires, triggering sprinklers and water damage.
Hackers last week accessed control systems at cold stores stocking blood products. The French blood service (EFS) said temperature and defrosting thresholds and been raised to “very high level” but that technicians had been alerted by alarm systems allowing them to disconnect the cold stores before the products were destroyed. It is not clear whether the two attacks are linked.
The following day retailers in 11 European countries including the UK, Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with refrigeration systems.
A regional branch of France’s Crédit Mutuel bank also reported losing more than €100m in a cyber-attack on Friday. The bank said it had recuperated some of the money.
The European Commission did not immediately comment on the French foreign minister’s statement. Kaja Kallas, the head of foreign affairs for the EU said: “We have the foreign affairs council next Monday, so we will have the opportunity to discuss this. These cyber incidents occurring in Europe, if attributed [to Iran], also call for a strong response on our part.”
In a significant decision this year, the EU designated the IRGC a terrorist organisation, ending years of division over the issue. The designation became possible after France dropped its long-held opposition, having previously feared it would damage diplomatic channels and the interests of French nationals in Iran.
