The Paris prosecutor’s office announced on Monday that a specialized cyber unit from Iran was responsible for a massive Iran cyberattack on France that targeted the nation's food supply chain. On October 11, hackers compromised the refrigeration systems of approximately 700 retail locations, leading to widespread food spoilage and triggering roughly 20 fires across the country as equipment temperatures were manipulated.
French Foreign Minister Jean-Noel Barrot described the incident on Tuesday as an act of unprecedented aggression. The government has indicated that it is considering a range of responses, including the summoning of the Iranian ambassador and a push for new European sanctions against those involved in the digital sabotage.
The Scope of the French Supermarket Hack
The October 11 operation was not a simple data breach but a physical disruption of essential infrastructure. According to investigators from the Paris public prosecutor's office, the grocery store refrigeration hack targeted major supermarket chains simultaneously. By gaining remote access to the cooling systems, the attackers were able to override safety protocols.
Key impacts of the attack included:
* 700 retail locations affected across France.
* Spontaneous fires at 20 sites caused by overheating units.
* Massive losses of perishable inventory due to food spoilage.
* Simultaneous disabling of emergency temperature alerts.
While the French grocery sector bore the brunt of the October 11 incident, the prosecutor's office noted that the hackers also targeted several French blood banks. Fortunately, in the case of the blood banks, samples and medical products remained undamaged.
Identifying Shahid Kaveh and the IRGC
French authorities have specifically named a group known as Shahid Kaveh as the perpetrators. This group is identified as a cyber-offensive unit operating under the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps (IRGC-ECC). The judicial investigation is currently focusing on the leader of Shahid Kaveh, his two primary deputies, and other unidentified members of the cell.
Investigators cited several pieces of digital evidence linking the group to the crime. The industrial refrigeration security breach involved the use of IP addresses that were traced directly back to devices located within Iran. Furthermore, the hackers utilized the Persian (Farsi) language within the code and interfaces used to conduct the attack, a methodology consistent with previous operations attributed to this specific Iranian unit.
Technical Manipulation of Cooling Systems
The methodology of the attack revealed a sophisticated understanding of industrial control systems. The attackers utilized web interfaces to take remote control of the refrigeration hardware. Once inside the system, they initiated "indefinite, abnormal defrost cycles" that caused temperatures to spike far beyond safe limits.
To ensure the damage was maximized, the hackers simultaneously disabled the safety alerts that usually notify store managers when temperatures exceed specific thresholds. This allowed the units to reach dangerous heat levels without detection, directly leading to the fires reported at twenty locations. The prosecutor's office has filed charges including "fraudulent interference with an automated data-processing system" and causing damage through means dangerous to persons.
International Reach and US Military Impact
The Iran cyberattack on France appears to be part of a broader trend of malicious activity targeting the global cold-chain. Following the October incident in France, similar hacks were reported in Belgium, Luxembourg, and Sweden. While officials have not officially confirmed that all these European incidents are linked to the same Iranian cell, the patterns of the attacks remain a point of concern for international security agencies.
In the United States, the Department of the Army Criminal Investigation Division is currently investigating refrigeration outages that occurred at six U.S. military bases in August. While no formal link has been established between the base outages and the French supermarket hacks, the timing has heightened concerns regarding the vulnerability of industrial refrigeration security.
FBI Security Recommendations
In response to the rising frequency of these attacks, the FBI’s cybercrime branch issued a warning regarding vulnerabilities in unpatched or internet-accessible controllers. The agency noted that security weaknesses allow foreign actors to alter system settings, leading to equipment damage and inventory loss.
To prevent further incidents, the FBI recommends that organizations:
* Remove refrigeration controllers from the public internet.
* Ensure all control systems are protected behind a robust firewall.
* Apply all necessary security patches to internet-accessible hardware.
French Foreign Minister Barrot emphasized that France "rules nothing out" regarding its eventual retaliation, calling the IRGC-affiliated unit "a terrorist organization that has committed an attack of unprecedented scale and aggression against our country."
Frequently Asked Questions
What happened during the Iran cyberattack on France?
In October, an Iranian cyber unit hacked the refrigeration systems of 700 French grocery stores, causing temperatures to rise indefinitely. This resulted in significant food spoilage and caused approximately 20 fires at retail locations.
Who is responsible for the French supermarket hack?
French prosecutors have identified the Shahid Kaveh unit, which is part of Iran's Islamic Revolutionary Guard Corps (IRGC), as the group behind the attack. The investigation is specifically targeting the unit's leader and his deputies.
How did the hackers control the refrigerators?
The attackers gained remote access through web interfaces, allowing them to start abnormal defrost cycles and disable safety alerts. This methodology was traced back to Iranian IP addresses and involved the use of the Persian language.