France accused Iran’s Islamic Revolutionary Guard Corps (IRGC) on Monday of carrying out cyberattacks that raised temperatures in supermarket refrigerators and freezers, and said those held responsible would face sanctions at the European level.
Foreign Minister Jean-Noël Barrot described the operation as “unprecedented in both its scale and its level of aggression.” Iran has not yet responded to the allegations.
The cyberattack last month pushed up temperatures in fridges and freezers at hundreds of supermarkets across France, spoiling fresh and frozen food estimated to be worth millions of euros. Last week, dozens of supermarkets in several other European countries were hit by a cyberattack aimed at refrigeration units as well. It is not known whether the two sets of incidents are linked.
Barrot said the attack on French supermarkets “marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.” He said the government had summoned Iran’s ambassador in Paris to “lodge a very strong protest against this extremely grave act.” France will take “any other necessary and proportionate measures” to respond to the incident and to “deter anyone who might seek to repeat it,” he added.
Also on Monday, Paris prosecutor Laure Beccuau said an investigation had been opened into the head of an offensive cyber unit associated with the IRGC, along with his two deputies. She named the unit as Shahid Kaveh, which she said is affiliated with the IRGC’s electronic and cyber center. Shahid Kaveh is the designation given to a cluster of hackers believed to be employed directly by the Iranian government.
On October 11, hackers gained control of the software that regulates temperatures in the refrigeration units used by many French supermarkets. More than 100 Coopérative U stores were affected, along with 180 outlets of Intermarché and its Netto brand. In some stores, refrigerator temperatures reportedly climbed to 50C (120F) overnight. Other major food retailers, including Carrefour, Monoprix and E.Leclerc, were also hit. The attack targeted software supplied by Danish engineering firm Danfoss, which allows retailers to manage cold units remotely.
Earlier this month, a second wave of hacks struck more than 100 stores across Europe. Supermarkets in Belgium and Luxembourg were affected, while a smaller number of shops were hit in Sweden, Ireland, the Netherlands, Estonia and Finland.
In August, refrigerators at a small number of US military bases malfunctioned for unexplained reasons, spoiling food. Those incidents are also being investigated as deliberate cyberattacks, people familiar with the matter said.
Since the waves of attacks on freezers, experts have been speculating about which hacking groups could be responsible, with Iran appearing on the list of potential suspects. Two Russian-aligned hacktivist groups claimed responsibility on Wednesday, but few believed them. The French government has not said how it reached the conclusion that Iran was responsible, and attributing cyberattacks is extremely difficult because hackers are able to hide their locations.