France blames Iran for cyberattack that wrecked fridges in 700 supermarkets

France on Monday formally accused Iran of an October cyberattack that knocked out refrigeration equipment in about 700 of the country's supermarkets in a single night. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Foreign Minister Jean-Noël Barrot said in Paris on the sidelines of G7 talks.

Barrot called it “an attack of unprecedented scale and aggressiveness” and the first large-scale cyberattack aimed at sabotage on French soil. “That is why it will not go unanswered,” he said, adding that sanctions would be imposed at European level on everyone responsible. France is summoning Iran's ambassador.

What happened in October

In the early hours of 12 October, the attackers remotely took control of supermarket refrigeration systems, and freezer temperatures stayed at around 50C for about six hours, the Associated Press reported. Food spoiled, and in some stores equipment melted or caught fire. Intermarché, Carrefour, Monoprix, Coopérative U and E.Leclerc stores were hit; Intermarché alone reported losses of tens of millions of euros in a single day.

ANSSI, France's cybersecurity agency, has linked the attack to Shahid Kaveh, a cyber unit affiliated with the Revolutionary Guards. Investigators cite Farsi-language material and IP addresses linked to devices in Iran. Paris prosecutor Laure Beccuau on Monday opened an investigation into organised cybercrime committed in the interests of a foreign power, Iran, and is seeking international arrest warrants for the group's leader and his two deputies.

Estonia hit too

In early November, supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia reported similar freezer failures. In Estonia, according to the public broadcaster ERR, one Selver store was affected: attackers heated a freezer to 50C, but the problem was fixed within minutes and there was no significant damage. It is not yet clear whether those incidents are linked to the attack in France; Paris has blamed Iran only for the October attack.

Iran routinely denies carrying out cyber operations against other countries. There was no official response from Tehran to the French accusation on Monday.