France accuses Iran of cyberattack on supermarket fridges, Revolutionary Guard unit under investigation

French justice suspects a unit of the Iranian Revolutionary Guards of being at the origin of the cyberattack which affected the refrigerators of French supermarkets on October 12, announced the Paris prosecutor's office in a press release Monday, November 9, confirming information from Le Figaro. A judicial investigation was opened against "the leader of the Iranian group Shahid Kaveh, an offensive cyber unit affiliated with the Electronic and Cyber ​​Center of the Revolutionary Guard Corps (IRGC-CEC), against his two deputies and against any other person who may be identified", according to the press release.

“I am able to confirm that responsibility for this attack lies with the Revolutionary Guard Corps of the Islamic Republic of Iran,” denounced French Foreign Minister Jean-Noël Barrot. “It is an attack of unprecedented scale and unprecedented aggressiveness,” lamented the head of diplomacy. “We will take sanctions on a European scale against all those responsible for this attack,” said the minister, who announced that he had “summoned the Iranian ambassador to France on Monday to protest very strongly against this extremely serious act.”

Around “700 mass distribution sites in France”, belonging to brands such as Système U, Intermarché or E.Leclerc, were affected by a cyberattack on October 12, targeting their fridges and freezers. The pirates had managed to remotely reach the refrigeration control systems of the Danish manufacturer Danfoss, then those of Dixell, causing "significant food losses and around twenty fire outbreaks" according to the Paris prosecutor's office. “The attackers took control of the equipment remotely via web interfaces to launch abnormal defrost cycles of unlimited duration, while deactivating the security alerts of the probes supposed to activate above a certain temperature,” details the press release.

“A characteristic attack mode of this unit”

The investigation opened after the cyberattacks was entrusted to the Anti-Cybercrime Office (OFAC) and the General Directorate of Internal Security (DGSI). Investigators have "uncovered, with the support of specialized state services, an attack mode characteristic of this unit, the use of Farsi and IP addresses referring to terminals located in Iran", specifies Paris prosecutor Laure Beccuau.

The judicial investigation was opened "on counts of fraudulent attacks on an automated data processing system in an organized gang and damage by means dangerous to people in an organized gang", details the Paris prosecutor's office. These two offenses are "aggravated by the circumstance of having been committed with the aim of serving a foreign power, in this case Iran, in addition to participation in a criminal association with a view to preparing a crime", adds the press release.