France says Iran behind ‘unprecedented’ cyberattacks on fridges

France on Monday said Iran’s Revolutionary Guards were behind cyberattacks on supermarket fridges in the country last month, vowing sanctions on a European level against Tehran over the first such large-scale cyber sabotage on French territory.

Numerous French supermarkets were hit in the October 11 and 12 cyberattacks, which raised the temperatures in their refrigerators, in some cases forcing them to throw away entire inventories of perishable food.

“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran,” foreign minister Jean-Noel Barrot said of the cyberattacks.

“This attack is unprecedented in both its scale and its level of aggression,” he said on the sidelines of the G7 foreign ministers’ meeting in Paris.

The Paris prosecutor said in a separate statement she had opened an investigation into Shahid Kaveh, a shadowy cyber unit of the IRGC, the Islamic republic’s ideological army, over the attacks.

The cyber monitoring centre of four French security agencies said the unit is better known in the cyber world as CyberAveng3rs, its avatar through which it has claimed attacks in the past.

“It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people,” said Barrot.

“We will implement sanctions at the European level against all those responsible,” he added.

Other countries hit

Barrot directly referred only to attacks against French supermarket systems, which he said targeted 700 sites.

However, similar incidents have been reported in other European countries.

On Nov 2, grocery stores across at least nine other European countries were hit by a suspected cyberattack on their freezer systems.

The incidents have shaken Europe at a time when officials have warned of the risk of cyberattacks from Russia while European countries press for support of Ukraine in its war against Moscow.

In recent days, European air traffic has also been disrupted by false bomb alerts against dozens of flights, although the origin of those threats has yet to be made clear.

The US and Israel fought a war against Iran that began with the killing of supreme leader Ali Khamenei on Feb 28.

European countries did not get involved in that conflict, but French officials have accused Iran of spreading misinformation related to the protests that have rocked France over the past month.

“It does not surprise us,” responded US Secretary of State Marco Rubio who is attending the talks in Paris. “They (Iran) have done things like this for a very long time.”

He described the IRGC as a “deranged group of revolutionaries” and asked “what kind of sickos are these people?”

‘IRGC cyber unit responsible’

Paris prosecutor Laure Beccuau said in a statement that a judicial investigation had been opened against the head of Shahid Kaveh and his two deputies.

She described the entity as “an offensive cyber unit affiliated with the Electronic and Cyber Centre of the Islamic Revolutionary Guard Corps (IRGC-CEC)”.

France’s Centre for Coordination of Cyber Crises, which groups together security agencies including the intelligence services, said the unit “conducts large-scale campaigns targeting industrial equipment for the purpose of sabotage, directed primarily against Israel and the United States, but also against France and other European countries”.

It named the men involved as Hamid Reza Lashgarian, who heads the IRGC-CEC cyberattacks branch of the IRGC and Reza Salarvand and Mahdi Lashgarian, who lead the Shahid Kaveh operation.

The US Treasury in 2024 announced sanctions against Hamid Reza Lashgarian and Mahdi Lashgarian as well as four other individuals over cyberattacks. It described Hamid Reza Lashgarian as a commander in the IRGC’s Quds force, which handles its foreign operations.

“A hallmark of this unit’s modus operandi is the use of the Persian language and IP addresses that trace back to terminals located in Iran,” said the Paris prosecutor.

She said attackers had taken control of the equipment remotely via web interfaces “to initiate abnormal, indefinite defrost cycles”.

Meanwhile, security alerts from sensors designed to go off when temperatures exceeded a certain threshold were “simultaneously disabled”, she added.

Barrot said France had summoned the Iranian ambassador to Paris “to lodge a very strong protest against this extremely grave act”.

“We will take any other necessary and proportionate measures — whether public or otherwise — to respond to this incident and deter anyone who might seek to repeat it,” he added.

Speaking after Barrot, EU foreign policy chief Kaja Kallas said that “our response should be strong”.

Subscribe to our newsletter and get news delivered to your mailbox.