Iran behind France grocery store refrigerator and freezer hacks, prosecutor says

French officials believe Iran was behind nationwide cyberattacks on commercial refrigeration units at hundreds of grocery stores in October, the Paris prosecutor’s office said Monday, accusing a cyber unit of Iran’s powerful Islamic Revolutionary Guard Corps of carrying out the costly hacks. 

The Oct. 11 hacking attack struck major supermarket chains, hitting “700 retail locations across France,” according to the prosecutor’s office, which said the attack caused “significant food spoilage and triggered roughly twenty fires” as the temperatures in refrigeration units shot up.

The attacks on the French grocery store chains were followed weeks later by similar hacks affecting refrigerators and freezers at supermarkets in Belgium, Luxembourg and Sweden. A separate cyberattack targeted several blood banks in France, but the products and samples were not damaged.

In August, refrigeration outages at six U.S. military bases sparked an ongoing investigation by the Department of the Army Criminal Investigation Division, Thomas Hamilton, a public affairs officer for the department, told CBS News.

There has been no assertion yet by officials in France, the U.S. or the other European nations hit by the hacks that all of the incidents were connected.   

In its statement Monday, the Paris public prosecutor’s office said its cybercrime division had opened a judicial investigation on charges including “fraudulent interference with an automated data-processing system and causing damage by means dangerous to persons — both committed as part of an organized group.”

It said the alleged offenses were “further aggravated by the fact that they were carried out to serve a foreign power — in this case, Iran — in addition to participation in a criminal conspiracy to prepare for the commission of a serious crime (felony).”

According to the allegations, the investigation is targeting the leader of an Iranian group known as “Shahid Kaveh,” which the prosecutor’s office described as “a cyber-offensive unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps (IRGC-ECC) — as well as his two deputies and any other individuals who may be identified.”

“The attackers gained remote control of the equipment via web interfaces, initiating indefinite, abnormal defrost cycles while simultaneously disabling safety alerts — alerts designed to trigger when temperatures exceeded specific thresholds,” the prosecutor’s office said, adding that the probe had “uncovered an attack methodology characteristic of this [Iranian] unit, including the use of the Persian (Farsi) language and IP addresses that trace back to devices located in Iran.”

In a statement shared on social media last week, the FBI’s cybercrime branch said that, along with its partners, it was “seeing malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems around the world,” noting that “security weaknesses in unpatched or internet-accessible controllers can allow attackers to change system settings, potentially causing inventory loss and equipment damage.”

The FBI urged all organizations that rely on such systems to take their controllers “off the public internet” and to keep access to the systems behind a firewall, in addition to other security measures.

There was no immediate response from Iranian authorities to the allegations by the French prosecutor on Monday, but the regime has threatened for months to expand its retaliation for the war launched by the U.S., and the ongoing U.S. naval blockade of its ports, using unspecified, asymmetrical means.

CBS News’ Karine Barzegar contributed to this report.

In: