France Blames Iran's Revolutionary Guards for Cold-Storage Cyberattacks

French agencies have attributed the October 11 hacking campaign that disabled refrigerators and freezers at 700 commercial sites across France to Shahid Kaveh, a cyber offensive unit tied to Iran's Revolutionary Guards. A joint report by French intelligence and cyber agencies named three alleged associates: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.

The announcement came only minutes after Reuters revealed that investigators privately suspected Iran. Paris prosecutors have requested international arrest warrants against the perpetrators, they said in a separate statement.

What did the attack actually do?

Hackers raised temperatures on cold-storage units until at least 15 fires broke out, the French report said. Supermarket employees carted boxes of perished meat and melted ice cream into trash containers in the hours after the incident.

One French supermarket owner estimated total costs could reach tens of millions of euros nationwide. Most affected sites were supermarkets. The campaign also hit small butcher stores, a slaughterhouse and foodstuff processing factories.

Foreign Minister Jean-Noël Barrot said France had summoned the Iranian ambassador. Barrot also threatened further EU sanctions against Iran. Iran's mission to the United Nations did not respond to requests for comment. Iran routinely denies conducting malicious cyber operations.

How did investigators link Iran?

French officials cited three lines of evidence:

• Ties between the incidents and the digital infrastructure used to sabotage the fridges;
• Matches between the intrusion pattern and other hacks attributed to Shahid Kaveh;
• Traces of Farsi (the Persian language) recovered in the attack infrastructure.

The report said the hackers operated through numerous front groups posing as vigilante hackers, including "CyberAveng3rs" and "Cyber Isnaad Front." Reuters could not locate contact details for the three named men, whose photographs appeared in the report.

Was this part of a wider campaign?

The October attacks ranked among the most disruptive cyber incidents of the Iran war that began in February. That conflict has seen scattered alleged digital disruption:

• Hacks against the Los Angeles transit system in March;
• Attacks on US water treatment plants in July;
• Hacks against ships bound for the United States in August.

A second wave struck more than 100 establishments across Europe this month. It reached refrigerators used by French blood banks, forcing employees to move blood stocks to other cold-storage units.

The European sabotage followed at least one similar US incident. In August, refrigerators failed at six or more military commissaries (Pentagon-run grocery stores). Pentagon investigators treat the malfunctions as a suspected cyberattack and are coordinating with French officials, Reuters reported last month. A person familiar with the matter said the Pentagon considers Iran a suspect in the commissary hacks. The investigation remains in progress, and Reuters could not establish how the military reached its determination. Nextgov first reported the US military's suspicion last month.

The Pentagon said on Monday it was "aware of speculation regarding a potential cyber incident" but could not comment further for security reasons.

How were the systems breached?

Cybersecurity experts previously told Reuters the hacks appeared easy to execute. The manufacturer behind many stricken units said several were obsolete or ran outdated firmware (built-in device software), which could have made intrusion simple.

Microsoft privately tied Iran to the October cold-storage sabotage at least two weeks ago, according to three people familiar with the matter. Microsoft declined to comment.

US officials warned this week that more attacks could follow. Iranian hackers have previously struggled to trigger widespread disruption, and the freezer sabotage stands as a notable exception.

Saher Naumaan, senior threat researcher at Proofpoint, said in an email that the cold-storage sabotage was less a measure of Iran's cyber prowess than of "how exposed these systems are."