French officials have accused Iran of orchestrating cyberattacks on supermarket refrigeration systems that affected 700 retail locations across the country, causing widespread food spoilage and around 20 fires.
The attacks on 11 October targeted major grocery chains, according to the Paris prosecutor’s office. Temperatures in refrigerated units rose after hackers interfered with their controls, leaving stores facing significant losses.
Investigators said the attackers gained remote access through web interfaces, started prolonged and abnormal defrost cycles and disabled alerts designed to warn staff when temperatures exceeded safe levels.
The Paris prosecutor’s cybercrime division has opened a judicial investigation into alleged interference with automated data-processing systems, damage caused by means dangerous to people and organised criminal activity.
The offences are also being investigated as having been carried out “to serve a foreign power — in this case, Iran”, alongside an alleged conspiracy to prepare a serious crime.
Investigation targets Iranian cyber unit
French prosecutors are targeting the alleged leader of an Iranian group known as Shahid Kaveh, along with two deputies and others who may be identified during the investigation.
The group has been described as a cyber-offensive unit linked to the Electronic and Cyber Center of Iran’s Islamic Revolutionary Guard Corps, or IRGC-ECC.
Investigators said the use of the Persian language and internet protocol addresses traced to devices in Iran formed part of a method they described as characteristic of the unit. The allegations have not been publicly answered by Iranian authorities.
Similar attacks were reported weeks later at supermarkets in Belgium, Luxembourg and Sweden. A separate cyberattack against several French blood banks did not damage products or samples.
French officials have not said that the incidents were connected. Refrigeration outages at six US military bases in August are also under investigation, but no link has been established between those events and the attacks in Europe.
Foreign Minister Jean-Noel Barrot said France “rules nothing out” in its response and described the IRGC-linked group as “a terrorist organization that has committed an attack of unprecedented scale and aggression against our country”.
France plans to summon Iran’s ambassador and seek European sanctions, Mr Barrot said, adding: “We will not stop at merely” those measures. He called the incident a major threat to the security of the French people and said the government was taking steps to deter further attacks.
The FBI’s cybercrime branch has separately warned of malicious activity targeting industrial refrigeration and cold-chain monitoring systems around the world. It said weaknesses in unpatched or internet-accessible controllers could allow attackers to alter settings, resulting in lost stock and damaged equipment.
The agency urged organisations using such systems to remove controllers from the public internet, place access behind a firewall and take additional security measures.
