On the night of 11 October, in as many as 700 supermarkets and shops across France, the machines that keep food cold were told to heat it instead. Someone far away took over the digital thermostats on thousands of freezers, fridges and chiller cabinets and drove them from as low as -27C to well over 50C. By morning, as the Guardian reported, thousands of tons of food had to be thrown out. In some stores the heat started fires, the fires set off sprinklers, and the water did its own damage. Some shops lost every perishable thing they had.
For four weeks the attack had no author. On Monday, 9 November, in Paris, where G7 foreign ministers had gathered, Foreign Minister Jean-Noël Barrot gave it one. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” he said, according to Al Jazeera. He called it “the first large-scale cyberattack carried out for sabotage purposes on French soil,” and promised that it “will not go unanswered.”
The unit with a martyr’s name
The Paris prosecutor, Laure Beccuau, named the instrument: Shahid Kaveh, which her office describes as a cyber-offensive unit attached to the Guards’ Electronic and Cyber Center. She has opened a judicial investigation against its head, his two deputies and “others who will be identified”, and requested international arrest warrants. The charges, as CBS News set out, include fraudulent interference with an automated data-processing system and causing damage by means dangerous to persons, committed by an organised group and aggravated because they were done “to serve a foreign power — in this case, Iran”.
A French government report names three men, Gizmodo reported: Hamid Reza Lashgarian, head of the Guards’ Electronic and Cyber Center, and Mahdi Lashgarian and Reza Salarvand, both commanders of Shahid Kaveh. The unit, Paris says, likes to work behind invented vigilante faces: CyberAv3ngers, Cyber Isnaad Front.
The prosecutor’s office described the method plainly. The attackers got in through web interfaces, set off “indefinite, abnormal defrost cycles” and switched off the alerts meant to warn staff when temperatures crossed safe limits. The trail back, France says, ran through Farsi and IP addresses tied to devices in Iran. The report from France’s Cyber Crisis Coordination Centre, described by The Register, adds that the same infrastructure had been used to scout Schneider Electric equipment at small energy and water plants, and that CyberbanNews, an Iranian outlet reportedly linked to the unit, was publicising the incidents “as early as October 13”.
No great cunning was needed. Experts quoted by NBC News, as Gadget Review noted, found many units running outdated firmware behind poorly secured web pages. Some affected Danfoss models no longer receive security fixes, TechCrunch reported. The head of the national cyber agency, Vincent Strubel, told the Senate the attackers relied on basic failings, among them equipment exposed directly to the internet and weak passwords, The Record reported. The doors had been left open long before anyone walked through them.
The ledger
The hit list reads like a weekly shop: Leclerc, Intermarché, Carrefour, Monoprix, Coopérative U, and in the government’s own account Casino and Metro too. Intermarché and its Netto brand lost at least 300 stores, U more than 100, Carrefour 80; Monoprix said about 5 percent of its roughly 490 shops were hit. The count of fires depends on who is counting: the cyber coordination centre says at least 15, the prosecutor roughly twenty. The Foreign Ministry puts the losses in the tens of millions of euros. The hackers also went after several small hydroelectric plants, with what the national cyber agency, ANSSI, called “moderate effects” in comments reported by NPR.
A war by other means
None of this happened in a vacuum. Since February, when the US- and Israeli-led war against Iran killed its supreme leader, destructive hacks blamed on Tehran have multiplied. CyberAv3ngers is suspected in July attacks on more than 100 exposed American water systems. In Israel in the spring, Cyber Isnaad Front claimed sabotage of a food processing plant, and in early October it released a propaganda video carrying a taunt in French about the country’s education protests, shortly before the French freezers failed. In August, refrigeration outages at six US military bases set off an Army criminal investigation; the Pentagon has said nothing official.
A reflection, not a finding: a state at war will look for its enemy’s softest point, and in a supermarket that point is a cheap controller nobody remembered to update. Ordinary people end up paying: the shop workers emptying shelves at dawn, the customers walking past empty cabinets.
What comes next
The Iranian ambassador was summoned on Tuesday morning, the Foreign Ministry told The New Arab, and Barrot raised the possibility of cyber measures of France’s own. The EU’s foreign policy chief, Kaja Kallas, said a Foreign Affairs Council on 16 November would take up the attacks: “If they are attributed, our response should be stronger,” she told Euronews. Tehran has not commented. It routinely denies malicious cyber operations.
Meanwhile the cold keeps failing elsewhere. On 2 November, three French blood-storage sites were hit; alarms warned technicians, who saved the plasma. Across Europe, retailers reported spikes in Belgium, Estonia, Ireland, Luxembourg and Sweden. Security Affairs counted at least nine countries; the Guardian counted 11, Britain among them. Paris has not tied that second wave to Iran. The FBI has urged operators to take their controllers off the public internet.
Gérôme Billois of Wavestone told the Guardian that a state group “that has the means, the determination and the time” is attacking easy equipment for now, and that “we should be prepared to see attacks on other systems like water or electricity.”