France has formally named Iran as responsible for a wave of cyberattacks on refrigerated and freezer units in supermarkets and blood banks. Foreign minister Jean-Noel Barrot said on Monday, November 9, that responsibility lies with the Islamic Revolutionary Guard Corps, according to TechCrunch, CNN and PBS NewsHour. Iran’s consulate in New York did not respond to TechCrunch’s request for comment, and no Iranian response was included in the coverage.
What Barrot said. According to TechCrunch, Barrot described the hacks as the first large-scale act of sabotage on French national territory and said they will not go without consequences. France summoned Iran’s ambassador and said it will pursue European-wide sanctions. Barrot said the matter is now with the French justice system.
What happened. Attackers remotely broke into web-based controllers of thousands of internet-connected industrial refrigerated and freezer units in France and the wider Europe and raised temperatures to spoil food, in two waves through October and into November, according to TechCrunch. Blood banks were also targeted, but the French Blood Establishment says the attacks were stopped before any blood was spoiled.
The scale differs by report. Other coverage, citing France’s national cybersecurity agency ANSSI, says attackers took over controllers at around 700 retail sites in France, from supermarkets to butcher shops, which would be about 700 of the country’s 10,000 supermarkets. TechCrunch’s wording of thousands of units and the agency’s count of around 700 sites measure different things, and the unit count is not given.
The evidence cited. Other reports say ANSSI attributed the attack to a group called Shahid Kaveh, described as a cyber unit affiliated with the Revolutionary Guard Corps, and that prosecutors cited the use of Farsi and IP addresses pointing to devices in Iran. Language and IP addresses can be faked, so these are indicators and not proof, and Iran has not accepted responsibility in the coverage.
The legal steps. A judicial investigation was opened on Monday into suspected organized cybercrime, and the Paris prosecutor’s office is seeking international arrest warrants, according to other coverage.
The equipment problem. Some affected models are made by Danish company Danfoss and no longer receive security fixes, according to TechCrunch. Similar attacks hit supermarkets in Sweden, Belgium and Ireland earlier this month, as covered on this site, though coverage says it is unclear whether those incidents are linked to the French ones.
The US angle. TechCrunch says US officials reportedly linked a freezer attack to Iran but that the US intelligence community has not made a formal public attribution, and the US is reportedly looking at freezers on military bases. The article also says the US government linked the attacks to pro-Iranian hacktivists, and it does not reconcile that with the lack of a formal attribution.
Why it matters. Connected industrial equipment is a target for governments as well as criminals, and spoiled food and blood supplies affect ordinary people. For businesses in the US and UK that use connected cold storage, the practical steps are to take web controllers off the open internet, replace units that no longer get updates, and use strong passwords and multi-factor authentication.
Sources: TechCrunch, CNN and PBS NewsHour. Details are as reported by those outlets and French officials, and Iran has not been quoted.
Freezer cabinet in a shop (representative image), Wikimedia Commons, public domain
