France has accused Iran's Islamic Revolutionary Guard Corps (IRGC) of being behind cyberattacks that raised the temperatures of supermarket fridges and freezers across the country last month, and has summoned Iran's ambassador in Paris to "lodge a very strong protest", according to the BBC and Al Jazeera. Foreign Minister Jean-Noël Barrot said the attack was "unprecedented in both its scale and its level of aggression" and that it marked "the first large-scale cyberattack aimed at sabotage on our national territory". He said it hit more than 700 French supermarkets on 11 and 12 October, when refrigeration units were remotely accessed to start abnormal, indefinite defrost cycles. Iran has not responded officially, though some Iranian media outlets have dismissed the allegations as baseless.
France's case is that the scale and the target make this an attack on the country and not a prank. Retailers including E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were hit, the attack targeted software from the Danish engineering firm Danfoss that retailers use to manage cold units remotely, and in some stores temperatures reportedly rose to 50C (120F) overnight. Al Jazeera reports that the raised temperatures forced supermarkets to throw away all perishable food, that millions of euros' worth of food was spoiled, and that in some cases the heat caused fires or melted equipment. The Paris prosecutor, Laure Beccuau, has opened an investigation into Shahid Kaveh, a cyber unit affiliated with the IRGC's electronic and cyber centre, and Al Jazeera reports that international arrest warrants have been requested for two of its officials. Barrot said France would push for European Union sanctions and "rule nothing out".
The weak point in the case is attribution, which the French government has not explained in public. The government has not said how it reached the conclusion that Iran was responsible, and the BBC notes that attributing cyberattacks is extremely difficult because hackers can hide their locations. A pair of Russian-aligned hacktivist groups claimed responsibility on Wednesday, though few believed them, and it is unclear whether the attacks, if carried out by the IRGC, were part of a deliberate deterrence strategy. The BBC also reports that some commentators and politicians in Iran have argued that retaliation should extend beyond the Middle East if the US and Israel resume the war they started earlier this year, which gives Paris's accusation a strategic setting without proving the link.
The incidents were not limited to France. A second wave earlier this month hit more than 100 stores across Europe, with supermarkets in Belgium and Luxembourg affected and a smaller number of shops hit in countries including Sweden, Ireland, the Netherlands, Estonia and Finland, and the BBC reported that the UK meat industry was hit by a cyberattack that targeted European supermarket freezers. Separately, in August a small number of US military bases had fridges malfunction, spoiling food, and Reuters has reported that this incident is also being investigated as a deliberate cyberattack. It is not known whether these instances are linked to the French attacks, and the French announcement does not claim they are, so the pattern remains an open question for investigators across several countries.
The next steps are diplomatic and legal. France says it will take "any other necessary and proportionate measures", including some it may not disclose publicly, to deter further attacks, and the prosecutor's warrants will test whether Iran or other governments cooperate. The wider issue is the vulnerability that the incident exposed: if a single piece of remote-management software can ruin the stock of hundreds of supermarkets in a night, then other everyday systems that depend on similar software are exposed to the same kind of attack. For retailers and software suppliers the lesson is practical, and for governments it is a sign that cyber sabotage has reached household infrastructure and is now treated as a matter of state security.
