France says Iran behind cyberattacks on supermarkets

‘UNPRECEDENTED’: France had summoned the Iranian ambassador to Paris ‘to lodge a very strong protest against this extremely grave act,’ a French minister said

France on Monday said Iran’s Islamic Revolutionary Guard Corp (IRGC) were behind cyberattacks on supermarket fridges in the country last month, vowing sanctions on a European level against Tehran over the first such large-scale cybersabotage on French territory.

Numerous French supermarkets were hit in the Oct. 11 and 12 cyberattacks, which raised the temperatures in their refrigerators, in some cases forcing them to throw away entire inventories of perishable food.

“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” French Minister of Foreign Affairs Jean-Noel Barrot said of the cyberattacks.

Employees fill boxes of perished goods outside a supermarket in Paris on Oct. 13, a day after a cyberattack targeted refrigeration systems at French supermarket chains.

Photo: Reuters

“This attack is unprecedented in both its scale and its level of aggression,” he said on the sidelines of the G7 foreign ministers’ meeting in Paris.

The Paris prosecutor said in a separate statement that she had opened an investigation into Shahid Kaveh, a shadowy cyberunit of the IRGC over the attacks.

The cybermonitoring center of four French security agencies said the unit is better known in the cyberworld as CyberAveng3rs, its avatar through which it has claimed attacks in the past.

“It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people,” Barrot said.

“We will implement sanctions at the European level against all those responsible,” he added.

Barrot directly referred only to attacks against French supermarket systems, which he said targeted 700 sites.

However, similar incidents have been reported in other European countries.

On Nov. 2, grocery stores across at least nine other European countries were hit by a suspected cyberattack on their freezer systems.

The incidents have shaken Europe at a time when officials have warned of the risk of cyberattacks from Russia while European countries press for support of Ukraine in its war against Moscow.

In the past few days, European air traffic has also been disrupted by false bomb alerts against dozens of flights, although the origin of those threats has yet to be made clear.

The US and Israel fought a war against Iran that began with the killing of then-Iranian supreme leader Ali Khamenei on Feb. 28.

European countries did not get involved in that conflict, but French officials have accused Iran of spreading misinformation related to the protests that have rocked France over the past month.

“It does not surprise us,” said US Secretary of State Marco Rubio who is attending the talks in Paris. “They [Iran] have done things like this for a very long time.”

He described the IRGC as a “deranged group of revolutionaries” and asked: “What kind of sickos are these people?”

Paris prosecutor Laure Beccuau said in a statement that a judicial investigation had been opened against the head of Shahid Kaveh and his two deputies. She described the entity as “an offensive cyber unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps [IRGC-CEC].”

France’s Cyber Crisis Coordination Center, which groups together security agencies including the intelligence services, said the unit “conducts large-scale campaigns targeting industrial equipment for the purpose of sabotage, directed primarily against Israel and the United States, but also against France and other European countries.”

It named the men involved as Hamid Reza Lashgarian, who heads the IRGC-CEC cyberattacks branch of the IRGC, and Reza Salarvand and Mahdi Lashgarian, who lead the Shahid Kaveh operation. The US Treasury in 2024 announced sanctions against Hamid Reza Lashgarian and Mahdi Lashgarian as well as four other people over cyberattacks. It described Hamid Reza Lashgarian as a commander in the IRGC’s Quds force, which handles its foreign operations.

“A hallmark of this unit’s modus operandi is the use of the Persian language and IP addresses that trace back to terminals located in Iran,” the Paris prosecutor said.

She said attackers had taken control of the equipment remotely via Web interfaces “to initiate abnormal, indefinite defrost cycles.”

Meanwhile, security alerts from sensors designed to go off when temperatures exceeded a certain threshold were “simultaneously disabled,” she added.

France had summoned the Iranian ambassador to Paris “to lodge a very strong protest against this extremely grave act,” Barrot said.

“We will take any other necessary and proportionate measures — whether public or otherwise — to respond to this incident and deter anyone who might seek to repeat it,” he added.

Speaking after Barrot, EU High Representative for Foreign Affairs and Security Policy Kaja Kallas said that “our response should be strong.”