Investigators say the hackers used Farsi and Iranian IP addresses. Paris has summoned Iran’s ambassador and wants EU sanctions.
France has accused Iran’s Revolutionary Guards of carrying out last month’s cyber-attack on supermarket fridges and freezers, which pushed temperatures to 50C or higher and destroyed food at about 700 stores.
Foreign minister Jean-Noël Barrot called the attack “unprecedented in both its scale and its level of aggression” and promised sanctions against those responsible at a European level.
Speaking at a meeting of G7 foreign ministers in Paris on Monday, he said it was “the first large-scale cyber-attack aimed at sabotage on French soil” and “will not go unanswered”.
Iran, which routinely denies carrying out cyber-attacks, had not responded.
Barrot said the French foreign ministry had summoned Iran’s ambassador to lodge a strong protest, and that France would take any other “necessary and proportionate measures” to deter further attacks.
The accusation came as G7 foreign ministers met to discuss ways to end the war in the Middle East.
Kaja Kallas, the EU’s foreign policy chief, said ministers would discuss the matter at the Foreign Affairs Council next Monday. Cyber incidents in Europe, “if attributed”, called for “a strong response”, she said.
The EU designated Iran’s Revolutionary Guards a terrorist organisation earlier this year, after France dropped its long-standing opposition.
On the same day, Paris prosecutor Laure Beccuau opened a judicial investigation into the head of Shahid Kaveh, a cyber unit linked to the Revolutionary Guards, his two deputies and others yet to be identified.
She said investigators had found the attackers used Farsi and IP addresses traced to devices in Iran. The investigation covers suspected organised attacks on computer systems and causing damage dangerous to people, aggravated by acting on behalf of a foreign power. Her office is seeking international arrest warrants.
Gérôme Billois, a partner at cybersecurity firm Wavestone, said Shahid Kaveh had been active since 2020, mostly targeting water systems in the US. He warned that a state group with “the means, the determination and the time” could move on to water or electricity networks.
On the nights of 11 and 12 October, hackers took over software that lets retailers manage their refrigeration units remotely, provided by Danish engineering firm Danfoss. While stores were closed, they pushed thousands of fridges, freezers and chiller cabinets from as low as -27C to 50C or more.
About 700 of France’s 10,000 supermarkets were affected, including stores run by Intermarché, Carrefour, Monoprix, E.Leclerc and Coopérative U. Thousands of tonnes of food had to be thrown away, and in some stores the heat started fires that set off sprinklers. One supermarket owner estimated the total cost at tens of millions of euros.
The company behind several of the affected units said many were obsolete or running outdated software, which may have made them easier to break into. Danfoss said it was working with customers to fix the problems.
A second wave of attacks on 2 November hit more than 100 stores across Europe, mostly in Belgium and Luxembourg, with smaller numbers in Sweden, Ireland, the Netherlands, Estonia and Finland. At least one Ikea store was affected. One report said retailers in the UK were also among those reporting problems with refrigeration systems.
The same week, hackers raised temperatures at cold stores at three sites run by France’s blood service, the EFS. Alarms alerted technicians, who disconnected the units before any blood was lost.
France has not blamed Iran for the later attacks. “Even if the modus operandi is similar, nothing at this stage allows us to confirm that it is the same attacker,” said Vincent Strubel, head of the national cybersecurity agency, ANSSI.
Two pro-Russian hacktivist groups claimed responsibility for the attacks last week, but few experts believed them.
Blaming a state for a cyber-attack is notoriously difficult, because hackers can disguise where they are operating from. Beyond the prosecutor’s mention of Farsi and Iranian IP addresses, the French government has not set out how it reached its conclusion.
Iran had been on experts’ lists of likely suspects since the first attack. Billois said only two countries were known for this kind of sabotage, Iran and Russia, and that the targeting of freezers pointed to Iran.
The attacks have exposed how many everyday systems, from shop fridges to blood stores, can now be controlled over the internet. Businesses in the UK can find guidance on securing connected equipment from the National Cyber Security Centre.