French Cyber Incident: IRGC Blamed for Supermarket Freezer Hack
Paris attributes the attack to Iran's Revolutionary Guard Corps, marking the first formal state attribution for a retail sector breach involving default password exploits.
By Riya Zhao ·
French authorities have formally attributed a cyberattack on supermarket refrigeration systems to hackers operating under the Islamic Revolutionary Guard Corps. This marks the first instance in which a state has been officially linked to a hack of this specific type. The Iranian military branch is a central component of the country's defense establishment.
The disruption caused physical damage to commercial equipment. Some refrigerators had their internal temperatures raised to the point where they caught fire. In the hours following the intrusion, store employees discarded large quantities of spoiled meat and melted ice cream. France's foreign minister described the incident as an act of unprecedented scale and aggression. The minister promised that Europe-wide sanctions would target the responsible parties.
This operation differed from previous Iranian cyber campaigns that included visible messaging. In 2023, state-backed groups interrupted television streams in the United Arab Emirates to broadcast a deepfake report on the Gaza war. In the same year, hackers affiliated with Iran displayed the slogan 'down with Israel' on screens for Israeli water-control equipment. The French incident carried no such overt communication.
The attack follows similar events in other regions. In May, industrial freezers at an Israeli food production plant were targeted. In August, freezer malfunctions spoiled food at US military bases. These previous incidents are now being treated as suspected hacks, though neither has been officially attributed to Iran. Rafe Pilling, senior director at Sophos, noted that the French attacks and a wave of rogue defrosting hacks across Europe last week are presumed to be linked.
Pilling observed that the attack used default passwords to gain access to fridge controls. He stated that this relatively unsophisticated method was consistent with Iranian capabilities. 'The attacks themselves were not particularly complex,' Pilling said. He explained that Iran generally uses cyberattacks to project power internationally and signal political displeasure to adversaries.
The incident occurred as the UK's national cybersecurity center warned that the country is in the foothills of a new cyber threat level. The center expects a huge rise in incident volume, citing artificial intelligence as a primary driver. AI capabilities allow attackers to find unforeseen flaws in IT systems and plan attacks more efficiently. However, the vulnerabilities in the French refrigeration systems were relatively easy to find and exploit without advanced technology.
Hostile cyber operations against the West are typically traced to four states. China focuses on industrial espionage and mass data gathering. Russia targets enemy infrastructure and spreads disinformation. North Korea hacks cryptocurrency exchanges to generate revenue. Iran uses these operations to put a shot across the bow of its enemies, according to cybersecurity experts.
