The Fraud Scheme & Investigation Details

French authorities have identified an Iranian state-sponsored hacking group, known as Shahid Kaveh and affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC), as responsible for a coordinated cyberattack that crippled refrigeration systems across more than 700 retail locations in France. The attacks, which occurred on the night of October 11-12, involved remotely manipulating industrial refrigeration controllers to increase temperatures, leading to the spoilage of vast quantities of food. The disruption was so severe that it also triggered at least 15 fires. France's Ministry for Europe and Foreign Affairs has strongly condemned these actions and stated its intention to summon Iran's ambassador to discuss the matter and propose further EU sanctions against those involved in malicious cyber operations. The investigation, led by France's Cyber Crisis Coordination Center (C4), linked Shahid Kaveh to the attacks through several key pieces of evidence, including the use of the same infrastructure for reconnaissance against industrial systems, the common use of the FOFA search platform, publicity of the attacks on a propaganda outlet associated with the unit (CyberbanNews), and the presence of Farsi language traces within the attacker's infrastructure.

Scope of Victims & Financial Losses

  • Over 700 French retail locations, including major supermarket chains like Casino, Leclerc, CoopĂ©rative U, Metro, Carrefour, and IntermarchĂ©, were affected.
  • Smaller businesses such as butcher shops, a slaughterhouse, and cooperative food-processing facilities also fell victim.
  • The attacks resulted in tens of millions of euros in food losses due to spoilage.
  • Significant material damage was incurred, including at least 15 fires.
  • During the same period, attacks were also detected against Schneider Electric industrial equipment at small hydroelectric installations, though these had a more moderate impact.

Key Takeaways & Prevention

This incident highlights the growing threat of state-sponsored cyberattacks targeting critical infrastructure and supply chains. While consumers are not directly targeted in this specific type of attack, the disruption to essential services can have indirect impacts. Businesses operating industrial control systems, particularly those in the food and energy sectors, must prioritize robust cybersecurity measures. This includes regular security audits, patching vulnerabilities, implementing strong access controls, and developing comprehensive incident response plans. Awareness of emerging threats and attribution of attacks to specific groups can help organizations better prepare and defend against future malicious activities. The French government's swift attribution and diplomatic response underscore the seriousness with which such cyber aggressions are being treated on an international level.