France officially holds Iran responsible for cyberattacks on supermarket refrigeration equipment

Official attribution and criminal case

France has officially held Iran responsible for cyberattacks on industrial refrigeration and freezer units in supermarkets. According to Le Figaro, cited by Anadolu, French intelligence linked the attack, which took place on the night of October 11–12 and affected several hundred supermarkets, to a cyber unit of the Islamic Revolutionary Guard Corps (IRGC). French Foreign Minister Jean-Noël Barrot confirmed this publicly, calling the attack the first large-scale act of sabotage on the country's territory and promising that it would not go unanswered. Reuters was the first to report the attribution, citing sources.

Paris's response: a case, the ambassador, sanctions

The Paris prosecutor's office has opened a criminal investigation into the head of the Iranian Shahid Kaveh group — an offensive cyber unit linked to the IRGC's Electronic and Cyber Center — as well as two of his deputies and other individuals who may be identified. The prosecutor's office said it had requested international arrest warrants. The Iranian ambassador will be summoned to the Foreign Ministry to convey the strongest possible condemnation: the ministry's spokesperson, Pascal Confavreux, called the attacks unjustifiable and unforgivable, in violation of international law, and reported significant material damage and food losses. France will also propose that its European partners impose new sanctions against the Iranian individuals and entities involved, and reserved the right to take additional measures. According to Barrot, the matter is now in the hands of French justice.

Scale of the incident and context

TechCrunch provides details: hackers remotely broke into web controllers managing fleets of industrial refrigeration units in grocery stores and raised the temperature to spoil goods. Two waves of attacks took place in October and November. Medical blood banks were also hacked; however, according to the French Blood Establishment, the attacks were stopped before any blood was spoiled. Researchers warned that vulnerable web controllers of certain models from the Danish company Danfoss no longer receive security updates. Similar attacks on refrigeration facilities have been recorded in other European countries — the United Kingdom, Germany, Italy, Portugal and the Netherlands. This comes against the backdrop of a series of attacks this year attributed to Iran and pro-Iranian hacktivists: earlier, US authorities warned about targeted attacks on American water suppliers, and the hack of medical device maker Stryker led to the mass failure of thousands of employees' devices. According to media reports, the US is also examiningwhether freezers on military bases were hacked, but the intelligence community has not yet made an official public attribution. The Iranian side had not commented on the accusations at the time of publication: TechCrunch's request to Iran's consulate in New York went unanswered.