First posted on Instagram
France on Monday formally accused Iran's Islamic Revolutionary Guard Corps of carrying out the cyberattacks that sabotaged refrigeration systems at about 700 supermarkets across the country last month, and the United States' top diplomat, Secretary of State Marco Rubio, said the accusation should not come as a surprise.
Rubio, who was in Paris for a meeting of Group of Seven foreign ministers, said Iran has carried out attacks like this "for a very long time" and described the Revolutionary Guard as a "deranged group of revolutionaries."
The attacks struck overnight on October 11 and 12. Hackers took control of refrigeration controllers — software made by the Danish engineering company Danfoss that retailers use to manage cold units remotely — and pushed defrost settings to high temperatures, in some shops driving cabinets to 50 degrees Celsius (122 Fahrenheit). Food spoiled in huge quantities, and at least 15 fires broke out as the units overheated. French officials estimate the losses at tens of millions of euros.
The chains hit included Carrefour, Intermarché and its Netto brand, E.Leclerc, Coopérative U and Monoprix. Intermarché alone accounted for about 180 stores, and Coopérative U lost control of more than 100. Staff had to throw away tonnes of chilled and frozen stock.
In a joint report issued by France's spy and cyber agencies, officials attributed the operation to Shahid Kaveh, a cyber-offensive unit tied to the Revolutionary Guard's Electronic and Cyber Center. The report said the hackers worked through front groups posing as vigilante hackers, including "CyberAveng3rs" and "Cyber Isnaad Front," and named three alleged associates: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.
Paris prosecutor Laure Beccuau announced a criminal investigation into the head of Shahid Kaveh and his two deputies, and has requested international arrest warrants for the three men. France's foreign minister, Jean-Noël Barrot, called the attack "unprecedented in both its scale and its level of aggression" and the first large-scale cyber sabotage campaign on French soil. He said France would push for sanctions at the European level against all those responsible, and that Iran's ambassador had been summoned to receive "a very strong protest against this extremely grave act."
Iran has not officially responded to the accusation. Some Iranian outlets have called the charge baseless, according to the BBC, and France has not published the evidence behind its attribution.
The French attacks were not the only ones. A second wave in early November hit more than 100 stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, though officials have not formally tied that wave to Iran. In August, refrigerators at a handful of U.S. military commissaries failed in a similar way, and investigators are examining whether those failures were deliberate attacks. On November 5, the U.S. Cybersecurity and Infrastructure Security Agency, the FBI and other American agencies published a fact sheet on the same kind of activity.