France Blames Iran’s Revolutionary Guards for Supermarket Fridge Hack

Trending Topics auf Google als bevorzugte Nachrichtenquelle festlegen.

Spoiled ground beef as a weapon: France says Iran was behind the cyberattack that pushed the refrigeration systems of about 700 supermarkets to as high as 50 degrees Celsius (122 degrees Fahrenheit) in mid-October. A hacking unit of the Revolutionary Guards carried out the attack, the French Foreign Ministry said on Monday. Paris is summoning the Iranian ambassador, calling for new E.U. sanctions and seeking international arrest warrants for three suspects.

What France Accuses Iran Of

France is specifically accusing a unit called Shahid Kaveh, which it says belongs to the cyber and electronic center of the Islamic Revolutionary Guards Corps. In a single night, the unit tampered with the defrost settings of refrigeration controllers, so that chilled cabinets and freezers heated up for hours. Fires broke out in at least 15 cases, and the ministry puts the food losses at tens of millions of euros. Chains including Carrefour, Leclerc, Intermarché, Coopérative U, Casino and Metro were hit, along with butcher shops, a slaughterhouse and food-processing plants.

The Foreign Ministry called it the first campaign on French soil carried out purely for sabotage. The attacks were unjustifiable and violated international law, it said. Speaking on the sidelines of a Group of 7 meeting in Paris, Foreign Minister Jean-Noël Barrot described an attack of unprecedented scale that would not go unanswered.

A second target had not been known until now: At the same time as the supermarkets, the attackers also went after Schneider Electric control devices in small French hydroelectric plants, with „moderate effects,“ according to ANSSI, the national cybersecurity agency.

The Evidence

ANSSI and the crisis center known as C4, which includes the intelligence services DGSE and DGSI, base the attribution on a cluster of indicators:

• Infrastructure: The servers used in the attack are said to have been used in April to scout Schneider Electric systems in France.
• Tools: The attackers used FOFA, a search engine that finds devices openly reachable on the internet and that the report describes as typical of the unit.
• Language and addresses: Traces of Farsi were found in the attack infrastructure, along with I.P. addresses from Iran, according to prosecutors.
• Propaganda: An online outlet linked to Shahid Kaveh, CyberbanNews, was spreading word of the attack the day after it became known.

The report does not say how the attackers technically got into the controllers, and it names no manufacturer. As Trending Topics reported, the weak point is control units from the Danish maker Danfoss, some of which have gone years without security updates and were reachable from the internet through an easily guessed login.

Arrest Warrants and Sanctions

The Paris prosecutor, Laure Beccuau, has opened a judicial investigation into organized cybercrime in the service of a foreign power. She is seeking international arrest warrants for Shahid Kaveh’s leader and his two deputies.

Politically, Paris is turning to Brussels: France plans to propose new E.U. sanctions against the Iranian individuals and organizations involved, and it reserves the right to take further „public and nonpublic“ measures. The E.U. sanctioned the Iranian hacking group Emennet Pasargad only in March. France blames that group for attacks on the satirical magazine Charlie Hebdo and for a foiled attempt during the 2024 Olympic Games to push doctored images of Israeli athletes onto public screens.

A Second Wave Across Europe

It remains unclear who is behind the later attacks. In early November, refrigeration systems were turned up in Sweden, Belgium, Ireland, Luxembourg and Estonia, and refrigerators at French blood banks were also attacked. France has not attributed that wave to Iran. According to the specialist blog Security Affairs, pro-Russian groups have claimed some of those incidents.

Reuters counts the fridge hacks among the most disruptive cyberattacks since the Iran war began in February. In the United States, the Pentagon is examining refrigerator outages at several military commissaries in August and considers Iran a suspect, the news agency reported.

Why France?

Paris has not named a motive. Relations between the two countries have been tense for months, however: In July, two French Embassy employees in Tehran were detained for hours, and in late September, Iran closed the French language center in the capital. ANSSI views earlier attacks on French targets as retaliation and intimidation, for instance after caricatures published by Charlie Hebdo.

Indicators, but No Public Proof

Tehran did not immediately comment, and Iran’s mission to the United Nations did not respond to Reuters’s requests. Iran routinely denies such operations. Fars, a news agency close to the Revolutionary Guards, had reported on the attacks without naming perpetrators and put the number of affected stores at about 150.

There are doubts within the security industry, too. The Italian security researcher Pierluigi Paganini wrote on Security Affairs that the attribution is, for now, an official claim and that France has not disclosed its technical evidence. Ken Munro of Pen Test Partners told Reuters after the second wave that the flaw was so simple to exploit that children playing around could be behind it. In their report, the French authorities themselves describe the basis for the attribution as a bundle of indicators.