France blames Iran's Revolutionary Guards for fridge cyber-attacks

France on Monday blamed Iran’s Revolutionary Guards for the October cyber-attacks that cranked thousands of supermarket freezers up to 50C, vowing European sanctions.

Foreign minister Jean-Noël Barrot named the Islamic Revolutionary Guards Corps (IRGC) at a G7 summit briefing in Paris, The Guardian reported. He called the attack “unprecedented in its level of aggression” and “a major violation of the nation’s interests,” Al Jazeera reported.

The attribution is the first time France has publicly pinned a large-scale sabotage hack on its soil to a foreign state military unit. It also gives Paris legal tools to act: the EU designated the IRGC a terrorist organisation in January, after France dropped years of opposition over diplomatic concerns.

The attacks hit on Oct. 11 and 12. Hackers seized remote control of digital thermostats in as many as 700 supermarkets and shops across France, pushing temperatures from as low as -27C up past 50C (122F) in some cases, The Guardian reported.

Thousands of tons of perishable food were dumped. In some stores the heat spike started fires, setting off sprinklers and causing water damage.

Five chains were hit: E-Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U, Al Jazeera reported. At least 300 Intermarché stores and its Netto brand were affected. Coopérative U lost more than 100 supermarkets, Carrefour 80, and Monoprix about 5% of its roughly 490 stores.

Paris prosecutor Laure Beccuau said investigators identified a “modus operandi” characteristic of Shahid Kaveh, a cyber warfare unit linked to the IRGC, The Guardian reported. The telltale signs included the use of Farsi and IP addresses traced to devices in Iran.

Her office opened an investigation against the head of Shahid Kaveh, his deputies and unidentified others, on charges of fraudulent attacks on an automated data processing system, organised crime, and causing damage dangerous to persons. The charges are aggravated, she said, by being committed to serve a foreign power.

Barrot said the Iranian ambassador had been summoned “to protest in the strongest possible terms.” He pledged “Europe-wide sanctions” and “proportionate and necessary” measures, public or private, to deter repeats, Al Jazeera reported.

The campaign did not stop at groceries. On Nov. 3, hackers accessed control systems at three cold stores holding blood products for France’s national blood service, the EFS, The Guardian reported. Temperature and defrosting thresholds were raised to “very high levels,” but alarm systems let technicians disconnect the cold stores before plasma and medicine stocks were destroyed.

The EFS supplies blood, plasma and platelets to more than 1,900 hospitals and supports more than 1 million patients a year.

A day earlier, retailers in 11 European countries reported refrigeration failures. Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden saw overnight temperature spikes on Nov. 2; Italy, Germany, Romania and the UK were hit the next day, The Guardian reported.

A regional branch of France’s Crédit Mutuel bank separately reported losing more than €100 million in a cyber-attack on Friday. The bank said it had recovered some of the money, The Guardian reported.

It is not clear whether the bank and blood bank attacks are linked to the supermarket hack. France has not attributed them publicly.

Gérôme Billois, a partner at cybersecurity firm Wavestone, said Shahid Kaveh has been active since 2020 and previously targeted water distribution systems in the US, The Guardian reported. “For the moment they are attacking easy equipment,” he said, “but as a state group that has the means, the determination and the time, we should be prepared to see attacks on other systems like water or electricity.”

The October attack exploited a vulnerability in refrigeration management software from the Danish company Danfoss, according to The Guardian. Danfoss said affected units were running outdated firmware and that it had long advised customers to update.

Kaja Kallas, the EU’s foreign affairs chief, said the bloc would discuss the incidents at next Monday’s foreign affairs council. “These cyber incidents occurring in Europe, if attributed to Iran, also call for a strong response on our part,” she said, The Guardian reported.

A similar pattern surfaced in the US in early August, when fridge malfunctions hit commissaries at at least six military bases. The Pentagon is investigating a suspected hack, The Guardian reported.

What I think

The striking thing about this attack is how low the bar was. The IRGC did not need a zero-day in a power grid or a custom exploit against a hardened target. It needed internet-connected fridges running firmware nobody had bothered to update, and a thermostat that would obey a remote command. That is what it got, in 700 stores, across a G7 country, overnight.

If a state military unit can spoil thousands of tons of food and nearly destroy blood stocks by talking to chillers over the internet, then the long-running debate about “critical infrastructure” has been asking the wrong question. The danger is not only the systems everyone agrees are critical, like power plants and water treatment. It is also the millions of connected devices nobody watches, installed by contractors, maintained by no one, and trusted by default.

France’s response, sanctions and a terrorism designation already in hand, is the right starting point. But sanctions punish after the fact. They do not patch a freezer in Rennes or a blood cold store in Paris. The cheaper and harder work is mundane: firmware updates, network segmentation, default-off remote access, and procurement rules that treat a supermarket chiller as the small piece of critical infrastructure it turns out to be.

The EU has now seen refrigeration, blood storage and a bank hit in one country in one month. If the pattern widens to water or electricity, as Billois warns, the food waste in French supermarket skips will look like the cheap lesson.