Paris says Iran-linked hackers sabotaged supermarket refrigeration systems last month. Tehran denies it, while Europe deals with a second wave of attacks, a run of bomb threats against flights and official calls to prepare for emergencies.
France has summoned Iran’s ambassador over a cyberattack last month that caused hundreds of supermarket refrigeration systems to overheat, with 15 reportedly catching fire. Iran’s foreign ministry rejected the allegation as baseless and hostile on 10 November, after the ambassador attended the summons that morning. The Paris prosecutor has requested international arrest warrants against two officials linked to an offensive cyber unit tied to Iran’s Islamic Revolutionary Guard Corps (IRGC). France is reportedly acting on US intelligence. The case comes as Europe contends with other hacks and bomb threats, and as the UK government urges households to stock up on emergency supplies.
What France alleges
According to the Paris prosecutor, as reported by CBS News, the attackers gained remote access to refrigeration controllers and set off abnormal defrost cycles that ran on indefinitely. At the same time, they switched off the automated temperature alerts, making it less likely that operators would spot the sabotage before damage was done.
French investigators found Persian-language traces, Iranian IP addresses and operating patterns they associate with Shahid Kaveh, the IRGC-linked unit, Le Monde and Axios reported. They also tied infrastructure used in the attacks to earlier scanning activity attributed to the same unit.
Paris prosecutor Laure Beccuau has requested the arrest warrants, according to Le Monde and Al Jazeera, and the investigation covers other suspects who may yet be identified. AFP reported on 9 November that investigators had named three Iranian officials: Hamid Reza Lashgarian, described as a senior figure in the IRGC’s cyber operations, and Reza Salarvand and Mahdi Lashgarian, who are linked to Shahid Kaveh’s activities. These are French allegations. No one has been convicted.
France’s response and the dispute over attribution
Foreign Minister Jean-Noël Barrot said Paris was not ruling out proportionate responses, including measures it might not disclose, Reuters reported on 10 November. France also intends to seek European Union sanctions against those responsible. EU foreign policy chief Kaja Kallas called for a strong response, AFP reported. Any sanctions would have to pass through the bloc’s decision-making process.
Not everyone is convinced by the public evidence. Peter Bassill, founder and chief information security officer of UK Cyber Defence, told The Grocer he had seen no convincing publicly available proof of Iranian responsibility. His criticism concerns the strength of the disclosed evidence. He has not pointed to another culprit.
How the systems were breached and what it cost
Vincent Strubel, head of France’s national cybersecurity agency ANSSI, told the French Senate that internet-exposed refrigeration controllers and weak access protections allowed the breaches, The Grocer reported on 10 November. He said earlier publicised flaws, involving default credentials and a password-generation feature, were not exploited in the October attacks.
French authorities put the number of affected retail sites at about 700, out of roughly 10,000 supermarkets nationwide, Deutsche Welle reported. That is about 7% of the supermarket network, though the sites included other retail premises. Axios reported losses in the tens of millions of euros from spoiled food and damaged equipment, and said no audited total has been established. The Grocer named Carrefour, Intermarché, Netto, Coopérative U and Monoprix among the affected companies. An intelligence report described activity against equipment at smaller French hydroelectric installations in the same operation, Axios reported. The reported effects were limited.
A second wave across Europe
Al Jazeera reported that a separate wave of refrigeration incidents on 2 November hit businesses in countries including Belgium, Estonia, Ireland, Luxembourg, Sweden and the Netherlands, about three weeks after the French attacks. One Swedish store found its cooling system had been set to 50C, Computing reported. The Grocer reported that a UK fruit-and-vegetable wholesaler and several meat suppliers were affected by similar incidents.
The retail cybersecurity intelligence group RH-ISAC reported that pro-Russian hacktivists had claimed the 2 November incidents. The claims are unverified, and France has not officially linked the second wave to Iran. Sweden’s civil defence minister, Carl-Oskar Bohlin, said it was too early to connect the Swedish cases with the French ones, because the method could be copied once it became public. He also warned that artificial intelligence could make it easier to find and exploit vulnerabilities, Deutsche Welle reported.
US warning on cold-storage systems
On 5 November, five US federal agencies issued a joint warning about an ongoing threat to industrial refrigeration systems, Reuters reported. They were the FBI, the Cybersecurity and Infrastructure Security Agency and the departments of Health, Transportation and Agriculture. The FBI said attackers had targeted refrigeration components at three blood-service facilities outside the United States, though the attempts failed because alert systems were working. The American Hospital Association warned that attacks on cold-chain systems could also disrupt the storage of temperature-sensitive medical products. US authorities advise organisations to take exposed controllers off the public internet, update firmware, change default credentials, separate industrial systems from other networks and verify temperature alerts independently.
Bomb threats against flights
The Guardian counted at least 34 flights disrupted by bomb threats across Europe in the first week of November, in a running tally on 5 November. Reuters reported that an Aer Lingus A320 carrying 151 passengers and six crew from Dublin to Rome was diverted to Évreux air base in France, where bomb-disposal teams inspected it. AeroTime reported that a Ryanair flight from London Stansted to Sofia was diverted to Plovdiv, and two other Ryanair flights, from Copenhagen and Madrid, were also affected, with Bulgarian fighter jets involved. Channel News Asia reported that Italian military aircraft escorted a Finnair flight from Helsinki to Rome, and another Finnair service to Vienna was also targeted. Both landed safely and the threats proved unfounded.
The EU used an established information-sharing mechanism on aviation security, and Transport Commissioner Apostolos Tzitzikostas confirmed contact with affected member states, according to AP and ITV News. Searches found no explosives. Authorities have not publicly said whether the threats were coordinated or linked to a government or group.
“Be Prepared” and the public response
The UK defence secretary has launched a “Be Prepared” campaign encouraging people to keep items such as canned goods, pet food, bottled water, medical supplies and spare cash in case of a major emergency. Some French presidential candidates have called such warnings fearmongering. The wider debate takes place as European representatives seek a place in US-brokered Russia-Ukraine discussions in Abu Dhabi, and as the “coalition of the willing” holds military drills in Poland. There are questions over whether a force led by France and the UK could keep the peace under an eventual deal or deter Russia.
Retail data published on 10 November points to a measured reaction. Worldpanel by Numerator figures, reported by ITV News, show 400,000 extra shoppers a day buying tinned meat, a rise of 43%, though the typical quantity stayed at around 500g. Worldpanel’s Fraser McKevitt told The Guardian that shoppers were generally adding emergency items to normal shops, and that fewer than a third of households bought bottled water in October. Barclays research found that 27% of respondents were stockpiling or thinking about it, with older adults generally better prepared. Grocery inflation rose slightly to 2.6% in the four weeks to 1 November, from 2.5%. Food producer Princes reported stronger demand for canned products after the campaign, The Independent said.
