Paris prosecutors probe Iran's Shahid Kaveh unit over supermarket fridge cyberattacks

Paris opens a judicial investigation

The Paris prosecutor's office opened a judicial investigation on Monday, 9 November, aimed chiefly at the leader of Shahid Kaveh, an offensive cyber unit linked to the Centre électronique et cyber of the Iranian Revolutionary Guards Corps. Two deputies of that leader are also targeted, along with any other person who might be identified. The charges cover fraudulent access to an automated data processing system and damage by means dangerous to people, both committed by an organised gang, plus participation in a criminal conspiracy to prepare a crime.

“Both offences are aggravated by the fact that they were committed to serve a foreign power, in this case Iran.”

Le Figaro reported on Monday evening that French intelligence had found indications pointing to the Iranian regime, and the prosecutor's statement confirmed that information.

How investigators built the case

Prosecutors said the case rests on several weeks of work by the Office anti-cybercriminalité and the Direction de la sécurité intérieure, supported by specialised state services. Investigators identified what the prosecutor called a characteristic mode of operation, namely the use of Farsi and IP addresses that lead to terminals located in Iran. The Paris prosecutor's office has requested international arrest warrants against the leader of Shahid Kaveh and his two deputies. The inquiry is not finished, and several European countries had already been hit by a similar cyberattack on 2 November.

Supermarkets hit in France and beyond

Bloomberg reported that around 700 supermarkets across France were affected by the cyberattacks that disabled refrigeration in October, causing food losses and fires. Supermarkets in the Netherlands, Belgium, Luxembourg, France and Scandinavia were targeted in the weeks before 9 November, with hackers switching cooling units to defrost mode. Staff emptied freezers to save products, while thousands of kilograms of food were sent straight for destruction. On Monday, 9 November, dozens of branches in Belgium and stores in Luxembourg, the Netherlands, Ireland, Estonia and Sweden were hit by a further cyberattack. The hackers reportedly exploited a known vulnerability at supplier Danfoss, which released a security update last year that not every operator has installed, and the update covered only products the supplier still supports.

Diplomatic response

Foreign Minister Jean-Noël Barrot said Iran is behind the attacks on freezers and cooling systems in several European countries. Barrot said the Iranian ambassador had been summoned. He also said sanctions would be pursued against Iran at a European level. According to French authorities, the attack was carried out by a cyber component of the Iranian Revolutionary Guards.

Security experts question the attacks

Keanu Nys, an ethical hacker at Spotit, told Belga that the attacks on the cooling systems point to insufficient action after the earlier French attack. He argued there is no reason such systems should be reachable from the open internet, since supermarkets can limit access to an internal network, for example through a VPN. Nys said these installations, known as operational technology, are generally less well secured than laptops, servers or printers, and are often installed by third parties, which leaves in-house teams without visibility of their safety systems. Because no financial gain is apparent, he offered two possible explanations: someone acting for fun, or a state seeking to cause panic. He said the identity of the attackers remains unclear.