Iranian hackers Shahid Kaveh France supermarket refrigerator cyberattack, Digi Mart USA News: Was the mid-October hacking of supermarket refrigerators a prank by a malicious hacker or a destabilization operation against France? French authorities have now settled the question, publicly attributing the sabotage to the Iranian regime’s cyber operatives.
The Center for Cyber Crisis Coordination (C4), which brings together ANSSI, the military procurement agency DGA, Comcyber, and the intelligence services DGSI and DGSE, publicly attributed the sabotage actions. The Paris prosecutor’s office has also requested a judicial investigation against hackers linked to the Iranian regime.
The investigation targets the leader of the Iranian group Shahid Kaveh, described as the offensive cyber unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps, along with its two deputies and any other person identified. The C4 named them as Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.
International arrest warrants have been requested by the public prosecutor.
French authorities had previously attributed a cyberattack last year to Russian military intelligence, but such public attributions remain rare. The prosecutor, Laure Beccuau, gave only a summary of the indicators behind the accusation, while the C4 provided considerably more detail.
According to the C4, the Shahid Kaveh unit has possessed, since at least June 2024, scripts capable of scanning, accessing and controlling industrial control equipment from Schneider Electric, Siemens and Rockwell. The infrastructure used for those earlier reconnaissance actions was also used in the supermarket refrigerator attack.
Traces of Farsi, the Iranian language, were found in that infrastructure, the C4 said.
The attack was carried out using the Fofa scanning tool, which Shahid Kaveh commonly uses, and it was claimed through CyberbanNews, the group’s propaganda outlet. State cyber experts also attributed several other attacks since 2020 to the group, including a 2023 data theft targeting the weekly Charlie Hebdo and a 2024 breach of a video display management company during the Paris Olympic Games.
The attack caused sudden defrosting of food products in about 700 stores across France, where storage facilities were equipped with Danfoss and Dixell controllers. The hacks also caused roughly twenty fires, the prosecutor’s office said.
Without detailing the method of operation extensively, the Paris prosecutor’s office said the attackers launched abnormal, unlimited-duration defrost cycles while disabling the safety alerts of probes that were meant to activate above a certain temperature. The judicial investigation has been entrusted to the Office anti-cybercriminalité (OFAC) and the Directorate-General for Internal Security (DGSI).
