France points finger at Iran over refrigerator cyberattacks

Focus of investigation is on the IRGC-affiliated Shahid Kaveh cyber gang

French officials suspect Iranian state-backed hackers were behind October’s fridge and freezer attacks as the EU warns of threats to food supply chain

French officials suspect Iranian state-backed hackers were behind the cyberattacks that knocked out commercial refrigerators and freezers across France last month, Reuters reported on Monday, citing two people familiar with the matter.

Hours later, French foreign minister Jean-Noël Barrot went further, telling reporters at a G7 meeting in Paris that responsibility lay with the Iranian Revolutionary Guards Corps (IRGC).

“We will impose sanctions at European level against those responsible,” Barrot said, adding that 700 food distribution sites in France had been affected. Iran routinely denies carrying out malicious cyber operations, and its mission to the United Nations did not respond to requests for comment.

French prosecutors have launched a formal investigation into the attack, with attention focused on the IRGC-affiliated Shahid Kaveh cyber gang. Officials have requested international arrest warrants be issued against the leader of the group, plus his two deputies.

Costly attacks on food supply

The attack on 11th October overrode temperature controls on fridges in hundreds of establishments. One French supermarket owner estimated the total cost could reach tens of millions of euros nationwide.

A second wave struck on 2nd November, hitting stores in at least eight European countries, including Belgium, Ireland, Luxembourg, the Netherlands and Sweden. One Swedish store reported its controls had been set to 50°C. French blood banks were also affected, forcing staff to move supplies to offline refrigerators, although the national blood service said it was not directly targeted.

Security researchers have linked the incidents to internet-connected units made by Danish firm Danfoss that were no longer receiving security updates. The firm behind many of the compromised units said several were obsolete or running outdated firmware, which would have made them easy to compromise.

Attribution contested

Attribution has been contested. Before the French announcement, many analysts had pointed towards Russia and its hybrid warfare campaign against Europe, although the Kremlin has denied involvement. A spokesperson for Belgium’s cybersecurity agency said earlier that it may never be possible to identify those responsible.

The hacks are among the most disruptive cyberattacks of the US Iran war. One source familiar with the matter told Reuters that the Pentagon considers Iran a suspect in August’s refrigerator failures at US military commissaries, though that investigation is still ongoing. Reuters could not establish a link between the incidents.

EU agriculture commissioner Christophe Hansen has called the repeated attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it”. The EU’s cybersecurity agency has urged member states to share information quickly and coordinate their response.

Dan Bird, EMEA Field CTO at Horizon3 says that we need to urgently consider the IoT security of other aspects of the food supply and wider building management systems in manufacturing.

“A hot war in one region is spilling into a global cyber threat, and refrigeration is just one casualty. I would say agriculture is similarly exposed. Poultry and pig sheds rely on automated ventilation and heating, and if those systems fail on a hot night, animals can die within hours.

"Data centres, mining, pharmaceuticals, and many manufacturing systems rely on cooling building management systems that are often internet-facing. Push up the temperature in a server hall and the hardware shuts itself down. Refrigerated lorries, port containers, pharmacy fridges and fertility clinics’ cryogenic storage are all monitored remotely. Water is a particular concern, and Iranian-linked hackers have targeted controllers at US water utilities before."