Fridge Cyberattacks: Paris Blames Iran's Revolutionary Guards

France on Monday accused Iran’s Revolutionary Guards of being behind the large-scale cyberattacks that targeted connected refrigeration systems at hundreds of supermarkets in October, promising sanctions “at the European level.”

“This is an attack of unprecedented scale and aggression,” Foreign Minister Jean-Noël Barrot said on the sidelines of a meeting with his G7 counterparts in Paris.

The Revolutionary Guards “have been carrying out acts of terrorism and sabotage around the world for a long time (...). But what is wrong with these sick people who attack refrigerators? France isn’t even really involved” in the conflict between the United States and Iran, US Secretary of State Marco Rubio said while in Paris.

The cyberattacks targeted Danfoss and Dixell refrigeration systems on the nights of October 11–12 and October 12–13. The first wave hit around 700 retail sites in France, causing substantial food losses and several fires.

With support from specialist government agencies, investigators “uncovered an attack method characteristic of this unit,” as well as “the use of Farsi and IP addresses linked to devices located in Iran,” Paris prosecutor Laure Beccuau said, referring to the Shahid Kaveh unit, which is affiliated with the Revolutionary Guards.

The Cyber Crisis Coordination Centre (C4), which brings together several government agencies, including the French National Cybersecurity Agency (ANSSI) and the Directorate-General for External Security (DGSE), said in a statement that a “body of evidence” pointed to the Islamic Revolutionary Guard Corps as having ordered the attacks and the Shahid Kaveh unit as having carried them out.

In early November, supermarkets in several European countries, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden, were also hit by cyberattacks that caused temperatures in their refrigerators to rise sharply.

The specialist press had pointed the finger at two pro-Russian hacking groups, NoName057(16) and Z-Pentest, already known for other operations carried out in Europe in recent years. On November 5, the Kremlin denied any involvement in the cyberattacks.