France blames Iran's Revolutionary Guards for the supermarket fridge cyberattack

France has now pointed the finger at Tehran. Paris prosecutors say an Iranian cyber unit is suspected of being behind the attack that hit supermarket fridges across the country in October.

Foreign Minister Jean-Noël Barrot called it "an attack of unprecedented scale and unprecedented aggressiveness".

What happened?

On Monday 9 November, the Paris prosecutor's office announced a judicial investigation into the head of Shahid Kaveh, a cyber-offensive group linked to the Cyber-Electronic Command of Iran's Revolutionary Guards. His two deputies and anyone else identified are also targeted.

Barrot said he could confirm that the Revolutionary Guards were responsible. He also said France had summoned Iran's ambassador to protest "very strongly" and would push for European-level sanctions against everyone responsible.

How do you hack a fridge?

In the night of 11 to 12 October, hackers took remote control of refrigeration systems made by Danfoss, then Dixell and Copeland. About 700 sites of big retail chains such as Système U, Intermarché and E.Leclerc were hit.

According to prosecutors, the attackers used web interfaces to launch abnormal, never-ending defrost cycles. They also switched off the safety alerts that should trigger when temperatures climb too high. The result: major food losses and around twenty small fires.

Investigators from the national anti-cybercrime office and the DGSI (France's domestic intelligence service) found a method typical of this unit. They also saw Farsi being used and IP addresses leading to devices located in Iran, said Paris prosecutor Laure Beccuau.

The charges include fraudulent attacks on data systems and damage by dangerous means, both as an organised group and aggravated by acting to serve a foreign power, here Iran.

What's next?

Similar attacks on cooling systems have recently hit supermarkets in several other European countries. Those have not yet been attributed to anyone.

Three sites of the French blood service, the EFS, were also hit. For now, the national cybersecurity agency ANSSI is not drawing a link: its head, Vincent Strubel, says the method is similar but nothing proves it is the same attacker.