Overview
On November 9, France's Ministry for Europe and Foreign Affairs formally attributed the October 11–12 cyberattacks on supermarket refrigeration systems to Iranian state-backed hackers. According to BleepingComputer, the attacks affected about 700 retail locations, caused food losses estimated at tens of millions of euros, and sparked at least 15 fires.
Attribution
The French Cyber Crisis Coordination Center (C4), which includes ANSSI, military cyber command and intelligence agencies, blamed Shahid Kaveh, a cyber-offensive unit linked to the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC).
CERT-FR says the unit operates under several personas:
- CyberAveng3rs
- Soldiers of Solomon
- Mr. Soul
- Cyber Isnaad Front
The CyberbanNews outlet, linked to the unit, publicized the attacks on October 13. Investigators also cited shared infrastructure with reconnaissance against Schneider Electric systems, use of the FOFA device-search platform, and Farsi-language traces.
How the Attacks Worked
Attackers compromised industrial refrigeration controllers and remotely raised defrost settings to high temperatures, defeating food preservation. Victims included stores of Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as smaller butcher shops, a slaughterhouse and food-processing cooperatives.
Investigators also detected attacks on Schneider Electric equipment at small hydroelectric installations during the same period and tied them to the same campaign.
Response and Scope
France will summon Iran's ambassador and propose new EU sanctions against the individuals and organizations involved. The attribution covers only the October supermarket attacks. France has not attributed a later wave affecting more than 115 stores across six European countries, nor a similar incident at the national blood service.
For defender guidance, see our earlier coverage of the joint US agency warning on refrigeration controller attacks.
Recommended Actions
- Remove refrigeration and building controllers from the internet. Use VPN or a jump host for remote access.
- Change default credentials and patch controller firmware.
- Alarm independently on temperature and defrost-setpoint changes, with a separate sensor path that does not trust the controller.
- Test manual fallback procedures for cold-chain operations.
- Review exposure of Schneider Electric and similar OT devices to device-search engines.