France, attack on supermarket refrigerators blamed on Iran

France has blamed Iran for sabotaging the refrigeration systems of about 700 stores, which happened overnight between 11 and 12 October. According to the French foreign ministry, behind it is Shahid Kaveh, the cyber unit of the Islamic Revolutionary Guard Corps. It matters because it is the first time a state has publicly named a culprit and because the targeted plants, similar to those of many companies, remain exposed online.

A few terms, before we get into the facts. IRGC is the Islamic Revolutionary Guard Corps, on which the accused unit depends. OT stands for operational technology, meaning the devices that control physical machines and plants. ICS are industrial control systems. CERT-FR is the French computer incident response center. Hacktivist is someone who presents themselves as an activist, but may act on behalf of a state.

What happened to the French supermarkets?

The attack hit chains such as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as butcher shops, a slaughterhouse and cooperative facilities, according to the CERT-FR report cited by BleepingComputer. The attackers compromised industrial controllers and remotely changed the defrost settings, pushing temperatures up to 50 degrees, as reported by Punto Informatico.

The authorities speak of at least 15 fires and tens of millions of euros of lost goods. Vulnerabilities in control systems made by Danfoss were exploited. We had already written about it in Danfoss and attacks on fridges, new wave in Europe.

What evidence supports the accusation against Iran?

The attribution comes from the French Cyber Crisis Coordination Center, which includes the ANSSI agency, the military cyber command and the intelligence services. According to CERT-FR there are four clues.

• The attacker's infrastructure was also used for reconnaissance on Schneider Electric systems, with techniques already associated with the unit.
• The FOFA search platform was used, which the group uses often.
• The propaganda channel CyberbanNews, linked to Shahid Kaveh, spread the attack on 13 October.
• Farsi-language traces were found in the infrastructure.

These are technical clues declared by the French authorities, not an independent verification.

Iran or pro-Russian groups, who hit Italy?

It is not clear. The attacks in other countries, Italy included, were claimed by the pro-Russian groups NoName057(16) and Z-Pentest Alliance. According to Cybersecurity360, the claim concerns the European wave of November and public investigations have not established whether the perpetrators match those of October.

Several researchers suspect, Punto Informatico reports, that the pro-Russian groups seized the opportunity to gain publicity. BleepingComputer notes that France attributed to Iran only the October attacks. On the Italian front we covered the topic in what happened and what to do.

What are the political consequences and the US warning?

Foreign minister Jean-Noël Barrot spoke of the first large-scale cyber attack with sabotage aims on French territory. Paris is summoning the Iranian ambassador and proposing new European sanctions. According to Cybersecurity360, the Paris prosecutor's office has opened an investigation into the unit's leadership.

Meanwhile, as The Hacker News writes, CISA, the FBI and other American agencies warn that refrigeration systems are being targeted worldwide. Among the countries hit is also Italy. Censys reports that exposed Danfoss StoreView instances fell from 3,004 to 708 between 9 October and 5 November.

Limits to know

The attribution to Iran is an official French position, not a judicial finding. It is not proven who hit the later waves, nor whether the pro-Russian groups really acted. We do not know the outcome of the prosecutor's investigation and we do not know whether the European sanctions will be approved. Damage estimates come from the authorities and could be revised.

What changes for those who work with digital systems

If you manage shops, warehouses or plants with connected controllers, the risk is concrete. American agencies ask you to identify systems reachable from the internet, change default passwords, remove unnecessary remote access and protect the necessary ones. OT devices should be isolated and obsolete ones replaced. Ask your plant supplier whether the firmware is up to date. For the Italian aspects see what changes for those who manage connected plants.

Our take

The case shows that cybersecurity is not only about data and email. A forgotten controller online, with the factory password, can cause fires. We think it is right for a state to expose those responsible, but political attention risks making people forget the practical point. Those who sell and install connected plants should deliver them already locked down and updatable. As long as exposure numbers stay high, geopolitics explains little and patches explain a lot.

Frequently asked questions

Who attacked the French supermarket fridges?

According to France, the Iranian unit Shahid Kaveh, linked to the IRGC. It is an official attribution based on technical clues, not a court ruling.

How many stores were hit?

About 700 in France, according to the French authorities. An early estimate spoke of 250-350 supermarkets. At least 15 cases involved fires.

Was Italy also hit?

Yes, Italy appears among the countries touched by the attacks. The claims came from pro-Russian groups, but there is no official confirmation of the perpetrators.

Which plants are vulnerable?

Controllers accessible from the internet, not updated or with weak configurations. The sources cite Danfoss StoreView and Copeland/Dixell XWEB among the exposed systems.

What should I do as an owner?

Check right away whether your controllers are reachable from the internet. Change default passwords and close unnecessary remote access.

Sanctions, investigation and exposure numbers to follow

The coming months will show whether the French accusation holds and whether the exposure of plants really drops.

• Follow whether the European Union approves sanctions against the named people and organizations.
• Watch whether the Paris prosecutor or other investigators link the November wave to the same group as well.
• Check the Censys data on exposed instances and the advisories from your plant supplier.

Sources

• punto-informatico.it, Attacco contro i frigoriferi francesi – gli autori sono iraniani
• bleepingcomputer.com, France blames Iranian hackers for supermarket attacks that sparked fires
• cybersecurity360.it, Attacchi ai frigoriferi, Iran o Russia? Le prove e i dubbi
• thehackernews.com, U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses