A cyberattack in October targeted refrigeration controllers at approximately 700 retail locations in France, with the French government attributing the attack to a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC). The attack occurred on the night of October 11, when the perpetrators accessed the controllers and altered the defrost settings to high temperatures, leading to food spoilage and fires at 15 sites. The cyber unit responsible, identified as Shahid Kaveh, is linked to hacktivist groups like CyberAveng3rs and Cyber Isnaad Front.
In response, France's Foreign Ministry intends to summon Iran's ambassador and push for new sanctions alongside European partners against those involved. A judicial investigation has been launched by the Paris prosecutor's office, targeting the head of the unit, deputies, and other identified individuals. They face charges of illegal interference with computer systems and causing dangerous damage, aggravated by their service to a foreign power.
The attack exploited web interfaces to take control of Danfoss and Dixell refrigeration controllers, disabling temperature probes' safety alerts and initiating endless defrost cycles. This led to around 20 fires and significant food losses, estimated in the tens of millions of euros. The affected sites included major retailers like Casino, Leclerc, and Carrefour, as well as small businesses such as butcher shops and food plants. Simultaneously, Schneider Electric equipment at small hydroelectric installations was also targeted, though the impact was moderate.
The attack is considered the first purely sabotage-driven cyber campaign on French soil. France's national cyber coordination center, C4, which includes ANSSI and other security services, confirmed the IRGC's involvement through several indicators. The same infrastructure was used for reconnaissance of Schneider Electric equipment, employing techniques linked to Shahid Kaveh since April.
France's CERT-FR issued an alert acknowledging ongoing compromises of remote refrigeration controllers across several product families, advising against exposing management interfaces to the internet. The alert, updated last on October 16, emphasizes that even non-compromised controllers face high risks if exposed, and a factory reset alone is insufficient for end-of-life devices without security updates.
