France Blames Iran's Revolutionary Guard for Supermarket Fridge Attack, Seeks Arrest Warrants and EU Sanctions

Since the early-October attack that sent refrigerator temperatures soaring at roughly 700 French supermarkets, and a second wave last week that reached stores across Europe, no government had named a culprit. Today, Monday, Nov. 9, France did.

Foreign Minister Jean-Noël Barrot said responsibility lies with Iran's Islamic Revolutionary Guard Corps. Speaking on the sidelines of G7 talks in Paris, he called it "an attack of unprecedented scale and aggressiveness" and "the first large-scale cyberattack aimed at sabotage on French soil."

"That is why it will not go unanswered," Barrot said.

What France says happened

Paris prosecutor Laure Beccuau opened a formal judicial investigation into suspected organized cybercrime, with the aggravating circumstance of having been "committed to serve the interests of a foreign power — in this case, Iran."

France's national cybersecurity agency, ANSSI, attributed the operation to Shahid Kaveh, which it describes as a "cyber unit" affiliated with the IRGC. Beccuau said the investigation targets the group's leader, his two deputies and anyone else who is identified. Her office is seeking international arrest warrants.

The evidence the prosecutor cited: multiple IP addresses traced to devices located in Iran, and an operation organized in Farsi.

A joint report by French intelligence and cybersecurity agencies goes further, according to Reuters. It names three alleged associates of Shahid Kaveh: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand. Reuters also reported that the report says the hackers worked through front groups posing as vigilante hackers, including "CyberAveng3rs" and "Cyber Isnaad Front." These are French allegations. No charges against any named individual have been announced.

The damage

Attackers took remote control of the software retailers use to manage refrigerators and freezers. Temperatures inside units reached 50°C (122°F) for about six hours, forcing stores to throw out fresh and frozen goods.

Prosecutors said the hackers triggered endless defrost cycles and disabled the alarms meant to warn staff. The systems were primarily made by Danish manufacturer Danfoss.

The prosecutor's office counted roughly 20 fires. The joint French report counts at least 15. Most targets were supermarkets, but the report says small butcher shops, a slaughterhouse and food-processing plants were also hit.

Les Mousquetaires, which owns Intermarché, said refrigerators at about 180 of its stores sat at 122°F overnight. CEO Thierry Cotillard put the one-day cost to French grocery chains at "tens of millions of euros."

Old gear, open door

Danfoss said when the attack hit that almost all of the compromised units were "legacy" products that "no longer receive software or security updates," and that it had urged French grocers to upgrade them.

That is a practical problem as much as a geopolitical one. Internet-facing controllers that no longer get patches were the entry point. Security researchers have since warned that the web-based controllers are vulnerable to remote attack.

Blood banks and other countries

Last week, another attack targeted several French blood banks and tried to push temperatures to extreme levels. The French Blood Establishment said it was stopped before any blood products or samples were damaged. ANSSI and Paris prosecutors are investigating that incident.

Also last week, supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia reported freezer and fridge failures. Monday's announcement addresses the October attack in France.

Sanctions and the wider picture

Barrot said he summoned Iran's ambassador to "strongly protest against this extremely serious act." He said France will push for sanctions at the European level "against all those responsible" and take "any other measures needed" to deter future attacks. Iran has not responded to the accusation, and a spokesperson for its consulate in New York did not immediately answer a request for comment from TechCrunch.

The French finding lands amid a string of cyber incidents the U.S. government has tied to pro-Iranian hacktivists working for Tehran, according to TechCrunch. They include attacks on U.S. water providers and a disruption at medical device maker Stryker. TechCrunch links them to the U.S.- and Israel-led war against Iran, which killed its supreme leader in February.

Last week the FBI and four other federal agencies released a joint fact sheet on the risk of a similar attack on American grocery stores and cold storage facilities. The U.S. is also reportedly examining whether freezer units on military bases were hit by earlier outages. U.S. officials have reportedly linked the freezer attacks to Iran, but the intelligence community has made no formal public attribution.

What comes next

Two things are now in motion. French judges will decide whether the arrest warrants go out for the Shahid Kaveh leadership. Brussels will decide whether Barrot's call for European sanctions turns into a package, and who is on the list. Whether Washington follows Paris with a formal attribution of its own freezer incidents remains open.