France Blames Iranian Forces for Supermarket Cyberattacks
French authorities have pointed fingers at Iran's Revolutionary Guards for recent cyberattacks that disrupted supermarket operations across the country.
On November 9, French officials charged Iran’s Revolutionary Guards with orchestrating a cyberattack that severely affected commercial refrigeration units in supermarkets throughout France. The incident led to the rapid deterioration of perishable goods and raised concerns about the broader implications for cyber warfare amidst ongoing tensions with Iran.
Impact of the October Attack
The cyberattacks, which emerged in early October, represent one of the most significant disruptions experienced in France since the onset of the conflict in February. These hacks resulted in substantial operational challenges for numerous grocery stores, with some refrigeration units reaching dangerously high temperatures, even causing fires in certain cases.
Employees at impacted supermarkets had to hurriedly dispose of spoiled meat and melted ice cream, with estimates suggesting total costs could soar to tens of millions of euros as a result of the attack.
Subsequent Attacks in Europe
In November, the situation escalated further with a new wave of cyberattacks that targeted over 100 establishments across Europe, including vital blood banks in France, forcing staff to transfer blood supplies to alternative storage facilities.
French Foreign Minister Jean-Noel Barrot announced that as a consequence, the Iranian ambassador was brought to the French foreign ministry for discussions, indicating potential further sanctions from the EU against Iran.
Link to Shahid Kaveh Unit
A joint investigation by French intelligence agencies implicated a cyber offensive unit known as Shahid Kaveh, linked to Iran’s Revolutionary Guards, as being responsible for the attacks. Additionally, specific individuals — Hamid Reza Lashgarian, Mahdi Lashgarian, and Reza Salarvand — were named as possible associates involved in the hacking campaign. However, efforts to contact these individuals have not yielded results.
The investigation revealed that the attackers used various front groups masquerading as independent hacktivists, notably “CyberAveng3rs” and “Cyber Isnaad Front,” to execute their plans.
Officials attributed the hacks to Shahid Kaveh by analyzing the digital patterns associated with the intrusion, ensuring connectivity to past Iranian hacking activities, and identifying traces of Farsi language in the hacking infrastructure.
International Ramifications and Investigations
A total of around 700 commercial entities were reportedly targeted, with the majority being supermarkets, but also affecting butcher shops, a slaughterhouse, and food processing factories. As investigations continue, officials and cybersecurity experts in both Europe and the US are grappling with the potential implications of these incidents.
Microsoft reportedly connected Iran to the October refrigeration sabotage weeks prior to the public announcements, although they have not commented on the specifics of this threat.
Notably, this incident mirrors a similar attack in the United States, where malfunctions were reported in refrigeration units at military commissaries. The Pentagon is treating these disruptions as potential cyberattacks and has implicated Iran as a suspect, though the investigation remains active.
Despite previous challenges in executing large-scale, disruptive cyberattacks, the recent fridge sabotages indicate a worrying evolution in Iranian cyber capabilities, prompting alerts from US officials about the possibility of further incidents.
Cybersecurity specialists emphasize that outdated systems likely contributed to the ease of breach experienced during the supermarket hacks, highlighting critical vulnerabilities in such cold storage units.
Saher Naumaan, a senior threat researcher at Proofpoint, noted that the incident underscores the significant exposure of these networks rather than solely demonstrating Iran's cyber skills.
