France blames Iranian state hackers for attacks on store fridges that sparked at least 15 fires

French authorities say the October attacks on supermarket refrigeration controllers sparked at least 15 fires, and on Nov. 9 Foreign Minister Jean-Noël Barrot named Iran’s Islamic Revolutionary Guard Corps as the party responsible. The intruders reached internet-exposed equipment overnight on Oct. 11 and 12, pushed temperatures as high as 50°C (122°F) and spoiled food at roughly 700 retail locations. Paris prosecutors have opened a formal judicial investigation aimed at a unit called Shahid Kaveh.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

Barrot described the campaign as an attack of unprecedented scale and aggression and said it would not go without consequences. He called it the first large-scale act of sabotage on French territory. France summoned Iran’s ambassador and said it would press for sanctions at the European level.

Shahid Kaveh and the evidence tying it to Tehran

According to BleepingComputer’s account of the French findings, the foreign ministry blamed Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of the Revolutionary Guard. Investigators pointed to four links: the same attacker infrastructure was used to scout Schneider Electric industrial systems with techniques tied to the unit, the attackers relied on the FOFA device search platform that the French computer emergency team says the group favors, a propaganda outlet named CyberbanNews publicized the attacks on Oct. 13, and Farsi-language traces turned up in the infrastructure.

The Associated Press, in a report carried by PBS NewsHour, adds that Paris prosecutor Laure Beccuau said the judicial investigation opened on Monday targets the unit’s leader, his two deputies and others who may be identified. Prosecutors are seeking international arrest warrants. The same report says ANSSI, the national cybersecurity agency, also ties Shahid Kaveh to earlier campaigns against France. TechCrunch, which first relayed the minister’s remarks in English, noted that an Iranian consulate spokesperson in New York had not responded to a request for comment, and that the hacks also reached medical blood banks, though the French Blood Establishment said the intrusion was stopped before any blood spoiled. Reuters had reported the attribution from sources before Barrot spoke, and the foreign minister said the matter now rests with the French justice system.

Danfoss controllers, 50°C defrost cycles and the fire count

BleepingComputer reports that the attackers compromised Danfoss refrigeration controllers and changed defrost settings to high temperatures. The “at least 15 fires” figure comes from French authorities as relayed in that report; other coverage of the attacks gives no count, and Al Jazeera’s Nov. 9 coverage says only that the heat in some cases sparked fires or melted equipment. A store manager’s account shows how the damage unfolded. Charles Dezon, who runs an Intermarché outlet, told reporters that the cold room reached 50°C and tripped the automatic sprinklers, according to ITPro’s October report, so some stores faced water damage as well as heat. The AP report adds that Intermarché counted losses of tens of millions of euros in a single day, and that temperatures held near 50°C for about six hours.

Why the equipment was reachable remains a plain engineering story. Vincent Strubel, ANSSI’s director, told French senators on Oct. 21 that the agency’s assessment pointed to exposed administration interfaces and weak passwords, as summarized in SentinelOne’s research write-up. Danfoss has said most affected systems were older products that no longer receive software updates, while Copeland described the weakness as sitting in a discontinued, end-of-life generation of controllers. Both manufacturers’ remote modules were named by France’s cybersecurity agency as compromised.

Roughly 700 stores in October and a separate November wave

Economy Minister Roland Lescure told Parliament in mid-October that about 700 of France’s 10,000 supermarkets were affected, calling the episode a wake-up call for everyone, as an Associated Press report from Oct. 14 recounts. Groupement Mousquetaires, parent of Intermarché and Netto, put its own tally at 300 stores. BleepingComputer’s version says officials now describe about 700 retail locations, up from an early estimate of 250 to 350 supermarkets, with food losses in the tens of millions of euros. Dominique Schelcher, chief executive of Cooperative U, said that targeting equipment essential to preserving fresh products is an attack on the French food supply chain.

The attribution has a boundary. BleepingComputer says France has pinned only the October attacks on Iranian hackers, not the later wave that hit stores in six other European countries; Al Jazeera lists Belgium, Estonia, Ireland, Luxembourg and Sweden as having reported overnight temperature spikes on Nov. 2. TechCrunch adds that officials described thousands of internet-connected industrial refrigeration and freezer units targeted across France and wider Europe in at least two waves, one in October and one stretching into November.

That leaves a question for the Paris investigators. SentinelOne wrote earlier in November that the available evidence did not yet establish who stood behind the European incidents, and whether the Shahid Kaveh findings extend beyond France is something the arrest-warrant inquiry has not yet answered in public.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.