Iranian hackers turned up the heat on French supermarket freezers, says France

Iran has been officially accused by France of being responsible for cyber attacks last month that meddled with supermarket freezers, causing some to catch fire.

According to French authorities, a hacking unit from Iran's Islamic Revolutionary Guard Corps (IRGC) sabotaged food refrigeration systems at approximately 700 retail sites, sparking at least 15 fires and causing tens of millions of euros worth of damage.

On the night of 11 October, the hackers seized remote control of refrigeration controllers and changed their defrost settings to high temperatures. As a report published by the French government’s computer emergency response team (CERT-FR) describes, victims of the attack included Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as butchers, a slaughterhouse, and food-processing plants.

According to French media reports, the targeted refrigeration controllers were made by Danish firm Danfoss, and the attackers targeted older versions of its software.

The finger of blame has been pointed by French authorities in the direction of Shahid Kaveh, a hacking unit within the IRGC. Evidence which is said to have led them to that conclusion includes that the same infrastructure was used, during the same period, to scan Schneider Electric equipment at energy and water facilities. and traces of Farsi. Perhaps the most telling clue of all, however, was that the attack was being trumpeted by a propaganda outlet linked to the hacking unit barely a day later.

Shahid Kaveh is said to hide behind a variety of different "hacktivist" guises including CyberAv3ngers, Soldiers of Solomon, and Cyber Isnaad Front.

The official French report names three men: Hamid Reza Lashgarian, head of the IRGC's Electronic and Cyber Center, and Shahid Kaveh commanders Mahdi Lashgarian and Reza Salarvand.

The same hackers are also believed to have targeted small hydroelectric facilities, while a second Iranian unit called Shahid Shoostari (also known as Emennet Pasargad), is held responsible for attacks on Charlie Hebdo and an attempt to hijack display screens during the 2024 Paris Olympics.

In early November there was a second wave of attacks on refrigeration units which hit businesses across Europe, including three French blood service sites. These attacks have not yet been officially attributed to Iran.

Regardless of who is behind the attacks, it is clearly important that any organisation properly defends its refrigeration systems to prevent tampering. As such, it remains good advice to ensure that operational technology (OT) interfaces are not exposed to the internet, that controller software is kept up to date, that default passwords are changed, and that OT networks are segmented and monitored for unexpected changes.

With fridge attacks like this continuing to create disruption and cost millions of euros, we can expect relations between Paris and Tehran to remain frosty for some time.