OMM Newsroom
France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of carrying out cyberattacks last month on supermarket refrigeration and freezer systems across the country. The attacks disrupted temperature controls at 700 commercial sites and caused at least 15 fires.
French Foreign Minister Jean-Noël Barrot called the attack “unprecedented” in scale and level of aggression on Monday, AnewZ reported. He said sanctions would be imposed at the European level against those responsible.
Barrot said the attack was the first large-scale cyberattack in France intended to cause disruption and had dealt a serious blow to the country’s interests and the safety of the French public. Iran’s ambassador was summoned to the French Ministry of Foreign Affairs and received, in Barrot’s words, a “very strong protest.” Barrot said France would also take “other measures that are necessary and proportionate” to respond and prevent similar attacks from happening again.
Iran has not yet responded to the accusations. Its mission to the United Nations did not answer requests for comment. Tehran regularly denies carrying out malicious cyber operations.
France made the announcement minutes after Reuters reported that investigators privately suspected Iran was behind the attacks.
Investigation into unit linked to the IRGC
Paris prosecutor Laure Beccuau said on Monday that an investigation had been opened into the head of a cyber unit linked to the IRGC and two of his deputies. The unit is called Shahid Kaveh and is affiliated with the IRGC’s electronics and cyber center, she said.
A joint report by French intelligence and cyber agencies named three people allegedly linked to the unit: Hamid Reza Lashgarian, Mehdi Lashgarian and Reza Salarvand. The report included photographs of them. Reuters was unable to find contact details for the individuals immediately.
According to the report, the hackers operated through several front groups presenting themselves as “hacktivist” groups seeking revenge, including “CyberAveng3rs” and “Cyber Isnaad Front.”
Basis for French investigators’ conclusions
The report said investigators linked Shahid Kaveh to the attacks on three grounds: traces in the digital infrastructure used to interfere with the refrigerators; methods consistent with the unit’s previous attacks; and traces of the Persian language in the attack infrastructure. Reuters could not independently determine exactly how French officials reached this conclusion. Identifying the source of cyberattacks is difficult because hackers can hide their location.
Microsoft had privately identified an Iranian connection at least two weeks before the October attacks, according to three people familiar with the matter. Microsoft declined to comment.
On Oct. 11, hackers took control of software regulating the temperature of refrigeration units used in many French supermarkets. The software, supplied by Danish engineering company Danfoss, allows retailers to control refrigeration units remotely.
Temperature settings were changed overnight. In some stores, refrigerators reportedly reached 50 degrees Celsius (120°F). Some units overheated and caught fire.
The French report says 700 commercial sites were targeted and at least 15 fires broke out. Most of the sites were supermarkets, but small butcher shops, a slaughterhouse and food-processing plants were also affected.
More than 100 stores in the Coopérative U chain were affected, as were a total of 180 stores operated by Intermarché and Netto. Carrefour, Monoprix and E.Leclerc stores were also hit.
In the hours after the attack, employees carried spoiled meat and boxes of melted ice cream to large waste containers. Fresh and frozen food worth millions of euros was destroyed. A French supermarket owner estimated that the total damage nationwide could reach tens of millions of euros.
Cybersecurity experts previously told Reuters the attack could be carried out easily. The company that made many of the affected units said some were outdated and others were running old software versions, which may have made the systems easier to access.
Earlier this month, a second wave of attacks targeted more than 100 businesses in seven other European countries. Supermarkets in Belgium and Luxembourg were hit, as were smaller numbers of stores in Sweden, Ireland, the Netherlands, Estonia and Finland.
Refrigerators at blood banks in France were also affected, forcing staff to move some blood supplies to other refrigerated storage facilities. It is not known whether the two waves of attacks were connected.
On Wednesday, two hacktivist groups known for their ties to Russia claimed responsibility for the attacks, but few people believed their claims. The simplicity of the attacks and their recurrence across several countries fueled speculation about who was responsible.
Possibilities under consideration included a Russian campaign of disruption in Europe, the war between the United States and Iran, and the global rise in cyberattacks using artificial intelligence. Iran was also among the potential suspects considered by experts.
Earlier incident at U.S. military bases
At least one similar incident was recorded in the United States before the attacks in Europe. In August, refrigerators stopped working at at least six U.S. military commissaries. Pentagon investigators are examining the failures as a possible cyberattack and are cooperating with French officials, Reuters reported last month.
A person familiar with the matter said the Pentagon considered Iran a possible suspect, but the investigation was ongoing. The news that the military suspected Iran was first reported by the Nextgov website.
The Pentagon said on Monday it was “aware of speculation regarding a possible cyber incident.” It said military investigators were examining the matter but could not comment further for security reasons.
Reuters could not independently establish whether the incidents in the United States, the attacks in France and the later wave of attacks in Europe were connected.
