Ing. Calogero Bono
France has blamed Iran for sabotaging the refrigeration systems of about 700 stores, which happened overnight between 11 and 12 October. According to the French Foreign Ministry, behind it is Shahid Kaveh, the cyber unit of the Islamic Revolutionary Guard Corps. It matters because it is the first time a state has publicly named a culprit, and because the affected systems, similar to those used by many companies, remain exposed online.
A few terms before we get into the facts. IRGC is the Islamic Revolutionary Guard Corps, which the accused unit belongs to. OT stands for operational technology, meaning the devices that control physical machines and plants. ICS are industrial control systems. CERT-FR is the French computer emergency response team. Hacktivist refers to someone who presents themselves as an activist, but may act on behalf of a state.
What happened to French supermarkets?
The attack hit chains such as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as butcher shops, a slaughterhouse and cooperative facilities, according to the CERT-FR report cited by BleepingComputer. The attackers compromised industrial controllers and remotely changed defrost settings, pushing temperatures up to 50 degrees, as Punto Informatico reports.
Authorities speak of at least 15 fires and tens of millions of euros in lost goods. Vulnerabilities in control systems made by Danfoss were exploited. We had already written about it in Danfoss and refrigerator attacks, a new wave in Europe.
What evidence supports the accusation against Iran?
The attribution comes from the French Cyber Crisis Coordination Center, which includes the ANSSI agency, the military cyber command and intelligence services. According to CERT-FR the clues are four.
- The attacker's infrastructure was also used for reconnaissance of Schneider Electric systems, with techniques already associated with the unit.
- The FOFA search platform was used, which the group often uses.
- The CyberbanNews propaganda channel, linked to Shahid Kaveh, spread the attack on 13 October.
- Traces of the Farsi language were found in the infrastructure.
These are technical clues declared by French authorities, not an independent verification.
Iran or pro-Russian groups, who hit Italy?
It is not clear. Attacks in other countries, Italy included, were claimed by the pro-Russian groups NoName057(16) and Z-Pentest Alliance. According to Cybersecurity360, the claim concerns the European wave of November, and public investigations have not established whether the perpetrators are the same as in October.
Several researchers suspect, Punto Informatico reports, that pro-Russian groups seized the chance to gain publicity. BleepingComputer points out that France attributed to Iran only the October attacks. On the Italian side we covered the topic in what happened and what to do.
What are the political consequences and the US warning?
Foreign Minister Jean-Noël Barrot spoke of the first large-scale cyberattack with sabotage aims on French territory. Paris is summoning the Iranian ambassador and proposing new European sanctions. According to Cybersecurity360, the Paris prosecutor has opened an investigation into the unit's leadership.
Meanwhile, as The Hacker News writes, CISA, the FBI and other American agencies warn that refrigeration systems are being targeted worldwide. Italy is also among the countries hit. Censys reports that exposed Danfoss StoreView instances fell from 3,004 to 708 between 9 October and 5 November.
Limits to know
The attribution to Iran is an official French position, not a judicial finding. It is not proven who hit the later waves, nor whether pro-Russian groups actually acted. We do not know the outcome of the prosecutor's investigation or whether European sanctions will be approved. Damage estimates come from the authorities and could be revised.
What changes for those working with digital systems
If you manage shops, warehouses or plants with connected controllers, the risk is real. American agencies urge you to identify systems reachable from the internet, change default passwords, remove unnecessary remote access and protect the access you need. OT devices should be isolated and obsolete ones replaced. Ask your equipment supplier whether the firmware is up to date. For the Italian angle, see what changes for those who run connected systems.
Our take
This case shows that cybersecurity is not only about data and email. A forgotten controller online, with its factory password, can cause fires. We think it is right for a state to expose those responsible, but political attention risks making people forget the practical point. Those who sell and install connected equipment should deliver it already locked down and updatable. As long as exposure numbers stay high, geopolitics explains little and patches explain a lot.
Frequently asked questions
Who attacked the French supermarket refrigerators?
According to France, the Iranian unit Shahid Kaveh, linked to the IRGC. It is an official attribution based on technical clues, not a court ruling.
How many stores were hit?
About 700 in France, according to French authorities. An early estimate spoke of 250 to 350 supermarkets. At least 15 cases involved fires.
Was Italy also hit?
Yes, Italy is among the countries affected by the attacks. The claims came from pro-Russian groups, but there is no official confirmation of who carried them out.
Which systems are vulnerable?
Controllers reachable from the internet, not updated or with weak configurations. Sources cite Danfoss StoreView and Copeland/Dixell XWEB among the exposed systems.
What should I do as an owner?
Check right away whether your controllers are reachable from the internet. Change default passwords and close any unnecessary remote access.
Sanctions, investigation and exposure numbers to watch
The coming months will show whether the French accusation holds and whether the exposure of equipment really falls.
- Follow whether the European Union approves sanctions against the named people and organizations.
- Watch whether the Paris prosecutor or other investigators link the November wave to the same group too.
- Check the Censys data on exposed instances and the advisories from your equipment supplier.
Sources
- punto-informatico.it, Attacco contro i frigoriferi francesi – gli autori sono iraniani
- bleepingcomputer.com, France blames Iranian hackers for supermarket attacks that sparked fires
- cybersecurity360.it, Attacchi ai frigoriferi, Iran o Russia? Le prove e i dubbi
- thehackernews.com, U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
