In October, French authorities attributed a widespread cyberattack on refrigeration systems at approximately 700 retail locations to a cyber unit within Iran’s Islamic Revolutionary Guard Corps (IRGC). The incident, which occurred on October 11, involved attackers altering defrost settings to high temperatures, leading to significant food spoilage and, in at least 15 instances, fires.
Details of the Attack
The cyber unit, identified as Shahid Kaveh, is widely recognized through its association with hacktivist groups like CyberAveng3rs and Cyber Isnaad Front. The French government has responded by planning to summon the Iranian ambassador and urging European allies to consider imposing new sanctions on the Iranian entities involved.
Following the attack, the Paris prosecutor’s office initiated a judicial investigation targeting the unit’s leadership and others identified in the operation. International arrest warrants have been sought, citing charges of illegal computer system interference and causing harm with foreign state interests.
Impact on Retail and Infrastructure
The attack, which remotely accessed Danfoss and Dixell refrigeration controllers via web interfaces, triggered abnormal defrost cycles and deactivated temperature safety alerts, leading to around 20 fires. Major retail chains such as Casino, Leclerc, and Carrefour were affected, alongside smaller businesses like butcher shops and food plants.
Additionally, the cyber crisis coordination center (C4) linked the attack to simultaneous targeting of Schneider Electric equipment at small hydroelectric sites, although the impact there was moderate. The ministry estimated the economic impact of the attack at several tens of millions of euros.
Investigative Findings and Security Recommendations
France’s C4, comprising national cybersecurity and intelligence agencies, identified four key indicators linking the attack to the IRGC and Shahid Kaveh. These included the use of specific infrastructure, reconnaissance techniques, and tools like FOFA for scanning.
In response, CERT-FR issued a security alert, advising organizations to remove internet exposure of vulnerable refrigeration units, review configurations, and restore access via secure networks. For compromised devices, a factory reset and adherence to manufacturer recommendations are essential to mitigate future risks.
With ongoing cybersecurity threats, it is imperative for affected operators to implement these measures to prevent further disruptions and protect critical infrastructure.
