France Blames Iran's Revolutionary Guard for Hacks That Spoiled Food in 700 Stores
The Paris prosecutor says an IRGC cyber unit seized control of supermarket refrigeration on Oct. 11, spoiling food and sparking about twenty fires.
French officials said Monday they believe Iran was behind a wave of cyberattacks that knocked out commercial refrigeration at hundreds of grocery stores across France in October.
The Paris public prosecutor's office accused a cyber unit of Iran's Islamic Revolutionary Guard Corps of carrying out the attack on October 11. It said the hack hit "700 retail locations across France" and caused "significant food spoilage and triggered roughly twenty fires" as temperatures in refrigeration units climbed.
Weeks later, similar hacks struck refrigerators and freezers at supermarkets in Belgium, Luxembourg and Sweden, and a separate cyberattack targeted several French blood banks, though the blood products and samples were not damaged. In August, refrigeration outages at six U.S. military bases prompted an ongoing investigation by the Army's Criminal Investigation Division, a spokesman, Thomas Hamilton, confirmed to CBS News. No official in France, the United States or the other affected countries has said all of the incidents are connected.
The Paris cybercrime division opened a judicial investigation on charges that include fraudulent interference with an automated data-processing system and causing damage by means dangerous to persons, both as part of an organized group. The prosecutor said the offenses were aggravated because they were committed to serve a foreign power. The probe targets the leader of an Iranian group called "Shahid Kaveh," which the prosecutor described as a cyber-offensive unit tied to the IRGC's Electronic and Cyber Center, along with its two deputies and anyone else who may be identified.
According to the prosecutor, the attackers took remote control of the equipment through web interfaces. They triggered "indefinite, abnormal defrost cycles" and disabled the safety alerts that normally fire when temperatures exceed set thresholds. Investigators said the method is characteristic of this Iranian unit, and cited use of the Persian language and IP addresses that trace back to devices in Iran.
Last week, the FBI's cybercrime branch said it and its partners were seeing malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems worldwide. The bureau warned that unpatched or internet-exposed controllers could let attackers change settings and cause inventory loss and equipment damage. It urged organizations to take controllers off the public internet and keep access behind a firewall.
Iranian authorities did not immediately respond. Iran has threatened for months to widen its retaliation for the war launched by the United States and for the continuing U.S. naval blockade of its ports, using unspecified asymmetrical means.
The accusation moves a string of puzzling outages into the realm of state-linked sabotage. Unlike data theft or ransomware, spoiled food and fires from overheated equipment put ordinary shoppers and workers at physical risk, which is why the French prosecutor treated the case as endangering people rather than as a computer crime alone.
