France blames Iran's IRGC for attack on 700 supermarket fridge systems

France has formally attributed last month's attack on supermarket refrigeration systems to Iran, and ANSSI announced it on X as part of a wider list of Iranian operations against French interests. In a statement on Monday, the national cyber agency ANSSI said France's Cyber Crisis Coordination Centre (C4) attributes the attack to Shahid Kaveh, an offensive cyber unit of the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps (IRGC). The attribution itself was made by the Ministry for Europe and Foreign Affairs.

The Paris prosecutor's office has opened a judicial investigation and asked for international arrest warrants against several members of the Shahid Kaveh group, ANSSI said on X.

What the attack did

ANSSI was alerted on October 12. Overnight from Sunday, October 11 to Monday, October 12, the threat actor compromised the refrigeration controllers at about 700 sites of large retail chains in France and changed their defrost settings to high temperatures. The result was spoiled stock and, in at least 15 cases, fires.

The statement adds victims that had not been made public: several small butcher's shops, a slaughterhouse and cooperative food factories. The C4 also saw Schneider Electric equipment at several small hydroelectric plants in France targeted at the same time, which it links to the same attack, with what it calls moderate effects on the equipment.

ANSSI lists the evidence behind the attribution as the characteristics of the attack infrastructure, the use of tools that identify the group, the relaying of the attack by a propaganda outlet linked to Shahid Kaveh, and traces of Persian in the attack infrastructure.

Earlier Iranian attacks on France

The C4 says IRGC cyber units have targeted French interests since at least 2020. It attributes to a second unit, Shahid Shoostari, the 2023 defacement and data theft at Charlie Hebdo's online shop that was carried out under the Emennet Pasargad name, and the compromise from July 20, 2024 of a French company that manages video display screens, where the threat actor tried to show images protesting Israeli athletes' participation in the Paris 2024 Olympics. That attempt was found before any images appeared.

What is not known

ANSSI does not say how the threat actor reached the refrigeration controllers, which equipment brands were involved, or whether the same unit is behind the attacks on supermarket refrigeration reported since then in other European countries. Iran had not responded to the French statement at the time of writing.