France Attributes Cyberattack on Retail Refrigeration Systems to Iranian IRGC Unit
France has officially blamed an Iranian IRGC cyber unit for a widespread sabotage attack on refrigeration controllers at approximately 700 French retail sites, causing significant food spoilage and fires.
France has formally attributed a significant cyberattack that disrupted refrigeration systems across roughly 700 retail locations to a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), known as Shahid Kaveh. The attack, which occurred on the night of October 11, involved attackers remotely accessing and manipulating refrigeration controllers, specifically altering defrost settings to high temperatures. This malicious action led to widespread food spoilage and, in at least 15 documented instances, triggered fires.
The French government announced its findings yesterday, stating that the Shahid Kaveh unit operates under hacktivist personas such as CyberAveng3rs and Cyber Isnaad Front, which have publicly claimed responsibility for some of its operations. In response to the incident, France's Foreign Ministry intends to summon Iran's ambassador and is urging its European partners to implement new sanctions against Iranian organizations and individuals implicated in the attack. Concurrently, the Paris prosecutor's office has initiated a judicial investigation into the unit's leadership and any other identified perpetrators, seeking international arrest warrants for offenses including illegal interference with computer systems and causing damage through dangerous means, with the motive of serving a foreign power.
According to the prosecutor's office, the attackers exploited web interfaces to gain control of Danfoss and Dixell refrigeration controllers. They initiated abnormal, unlimited defrost cycles and disabled safety alerts designed to trigger at high temperatures. The scale of the damage was substantial, with the attack causing approximately 20 fires and significant financial losses. The primary targets were large retail chains, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, though smaller businesses like butcher shops, a slaughterhouse, and food processing plants were also affected.
In addition to the retail sector, France's cyber crisis coordination center (C4) linked the attack to the simultaneous targeting of Schneider Electric equipment at several small hydroelectric installations, though the impact on these sites was reportedly moderate. The C4, a collaborative body comprising France's national cybersecurity agency (ANSSI) and intelligence services, identified four key indicators pointing to the IRGC's sponsorship and Shahid Kaveh's execution of the attack. These indicators included the use of attack infrastructure also employed for reconnaissance of Schneider Electric equipment, employing techniques consistent with Shahid Kaveh's past activities, the use of the FOFA scanning tool, and early reporting of the incident by CyberbanNews, a propaganda outlet associated with the unit.
The investigation, conducted by France's anti-cybercrime office (OFAC) and the DGSI, further corroborated the attribution by identifying an attack methodology typical of Shahid Kaveh, the use of Persian language indicators, and IP addresses traced back to Iran. The C4 noted that Shahid Kaveh has a history of targeting industrial equipment, including previous campaigns against Israeli companies and interests involving industrial control systems and refrigeration equipment. France's official attribution does not, however, reference the recent wave of similar refrigeration attacks reported in other European countries.
France's CERT-FR issued an alert detailing compromises affecting remote refrigeration controllers across several product families, including Danfoss AK-SM and AK-SC series, Copeland xweb, and Dixell xweb. The alert, updated on October 16, warned that such attacks might still be ongoing and emphasized that exposing management interfaces to the internet is a violation of best practices. For uncompromised controllers, CERT-FR recommended removing internet exposure, reviewing configurations, and restoring access only via secure VPNs or protected networks. For compromised devices, the advice included factory resets, reconfigurations, and strict adherence to manufacturer security recommendations, particularly for end-of-life devices that are highly vulnerable to repeated compromise.
The French government estimated the total food losses from the attack to be in the tens of millions of euros, characterizing the operation as the first purely sabotage-driven offensive cyber campaign on French soil. This incident underscores the growing threat of state-sponsored cyberattacks targeting critical infrastructure and supply chains, with significant economic and physical consequences.
The investigation into the supermarket refrigeration attacks has identified the Shahid Kaveh unit, linked to Iran's IRGC, as the primary target. Prosecutors cited the use of Farsi language and Iranian IP addresses as key evidence, with the inquiry specifically naming the unit's leader and deputies. While the exact entry method remains unconfirmed, Franceinfo noted a previously disclosed authentication weakness in Danfoss AK-SM 800A systems, though its direct use in this attack has not been established.
French authorities have escalated their response by requesting international arrest warrants for individuals believed to be connected to the Islamic Revolutionary Guard Corps (IRGC) cyber unit implicated in the attack. While the initial report focused on the attribution and the scale of the damage, this update highlights the legal and diplomatic actions being taken by France in response to the cyber sabotage.