France Blames Iran for Major Refrigeration Cyberattack

By Amara Osei

Hackers remotely raised refrigeration temperatures at as many as 700 French supermarkets and shops, and the Paris public prosecutor opened an organized-crime inquiry on the Monday after the 11 and 12 October attacks. France’s government attributed the operation to Iran’s Revolutionary Guards. The operation spoiled food, damaged stores and placed a digital thermostat at the centre of a diplomatic dispute.

What did France conclude about responsibility?

At a press briefing during the G7 summit in Paris, Foreign Minister Jean-Noël Barrot said: “Thanks to the remarkable efforts of government agencies, I am able to confirm that the Islamic Republic of Iran’s Revolutionary Guards are responsible for this attack.”

Barrot called the operation unprecedented in scale and aggression. He said Europe-wide sanctions would be imposed against those responsible and that the attacks violated France’s national interests.

France summoned Iran’s ambassador to lodge the strongest possible protest over what Barrot described as an extremely serious act.

The French government has made the attribution; the criminal case remains at investigation stage.

What has the Paris prosecutor alleged?

On that Monday, Paris public prosecutor Laure Beccuau said specialist investigators and government agencies had identified a modus operandi characteristic of Shahid Kaveh, a cyberwarfare unit linked to the Revolutionary Guards.

Investigators cited the use of Farsi and IP addresses traced back to devices located in Iran. Her office opened an investigation against the head of Shahid Kaveh, his deputies and others yet to be identified, on charges of “fraudulent attacks on an automated data processing system committed as part of an organised crime ring and of causing damage dangerous to persons.”

Beccuau said the alleged offenses were aggravated because they served a foreign power, Iran.

The file alleges an Iran-directed operation, not a judicial finding of guilt.

How extensive was the disruption?

Hackers remotely overrode the temperature settings on thousands of freezers, fridges and chiller cabinets across France, driving temperatures from as low as -27C (-16.6F) to well above 50C (122F) in some cases.

• French retail: Cyberattacks hit swathes of supermarkets on 11 and 12 October, forcing some stores to discard entire inventories of perishable food.
• Food loss: Stores dumped thousands of tons of perishable stock.
• Physical damage: The extreme heat triggered fires in some stores, activating sprinklers and causing water damage.
• European reach: Similar incidents surfaced since, including supermarket fridges in other European countries last week. The following day, retailers in 11 European countries reported refrigeration problems. Those countries included the United Kingdom, Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden.

The disruption crossed borders quickly, making refrigeration an unusually literal target.

What happened to blood and banking systems?

• Blood storage: Last week, hackers accessed control systems at cold stores stocking blood products. The link to the supermarket attacks remains unclear.
• EFS response: The French blood service raised temperature and defrosting thresholds to a very high level. Alarm systems alerted technicians, who disconnected the cold stores before products were destroyed.
• Banking: A regional branch of Crédit Mutuel reported losing more than €100 million in a cyberattack on Friday. The bank recovered some of the money.

Alarms limited the blood-product loss; the bank recovered only part of its cash.

How credible is the attribution?

Gérôme Billois, a partner at cybersecurity and technology company Wavestone, said Shahid Kaveh had operated since 2020 and was known mainly for cyberattacks on water-distribution systems in the United States.

He identified Iran and Russia as the two countries known for this kind of attack. Because the supermarket and blood-bank incidents both concerned freezer controls, he considered a direct Iranian link reasonable.

Billois said the group currently targets relatively easy equipment. Because a state group has resources, resolve and time, he warned that attacks could extend to water or electricity systems.

His warning identifies a risk; it does not establish another attack.

What could Europe do next?

The European Commission did not immediately comment on Barrot’s statement. Kaja Kallas, the EU’s foreign-affairs chief, said the Foreign Affairs Council would meet the following Monday to discuss the incidents.

She said cyberattacks in Europe, if attributed to Iran, called for a strong European response.

Earlier this year, the European Union designated the Revolutionary Guards a terrorist organization, ending years of division. The decision followed France dropping its opposition, which had rested on fears of damage to diplomatic channels and the interests of French nationals in Iran.

Europe now has a designation, a council meeting and a French investigation; the thermostat remains the common denominator.

What does this mean for practitioners?

For practitioners, the practical consequence is legal characterization. The French inquiry treats the alleged compromise of automated data-processing systems as organized crime involving a foreign power, not equipment malfunction. Barrot’s stated sanctions and the EU council discussion also make attribution a regulatory and diplomatic issue, not only an incident-response matter.

The French attribution remains a government position, while the criminal inquiry has produced no judicial finding.