Iranian Hackers Target Hydroelectric Plants, Raise Security Concerns in France
In a significant escalation of cyber warfare, the French government has officially attributed a series of extensive cyberattacks to hackers associated with Iran. These attacks, which occurred in mid-October, specifically targeted refrigeration systems in French supermarkets and hydroelectric plants, marking a new level of aggressive cyber tactics that have raised alarms across Europe.
The French authorities characterized this campaign as "unprecedented" in terms of scale, impact, and aggression. The cyberattacks primarily focused on the poorly secured controllers of refrigeration units in approximately 700 supermarkets. The hackers exploited these vulnerabilities to raise temperatures within the refrigeration systems to alarming levels, as high as 50 degrees Celsius (122 degrees Fahrenheit). Consequently, millions of euros’ worth of food spoilt, leading to significant financial losses for supermarket chains (see: Hackers Attack French Supermarket Freezers Causing Food Loss).
It is noteworthy that these cyber incidents were not isolated to France alone. In the same period, similar cyberattacks were reported in various other European countries. Moreover, an unsuccessful attempt was made to remotely sabotage cooling facilities at French blood banks. While the latter incidents may have been copycat attacks, they nonetheless underscore the growing threat posed by cybercriminal activities in this sector.
Attribution of cyberattacks presents a complex challenge, as perpetrators often take measures to obscure their identity. However, the French Cyber Crisis Coordination Center (C4)—an interministerial body that includes the nation’s cybersecurity agency, ANSSI—has expressed confidence in its conclusion regarding the origins of the October supermarket attack. C4 explicitly linked these acts to the Shahid Kaveh cyber-offensive unit, associated with Iran’s Islamic Revolutionary Guard Corps (IRGC).
In a detailed statement, C4 reported that the attacks led to at least 15 fires and impacted not just large supermarkets but also smaller entities such as butcher shops and food processing plants. Significantly, the report indicated that certain equipment from Schneider Electric located in small hydroelectric installations in France was also targeted, albeit with moderate effects.
Polish cyberwarfare expert Lukasz Olejnik weighed in on the issue, highlighting that the French government’s decision to publicly attribute the attacks to Iran was both predictable and understandable. He emphasized that such coordinated cyber operations causing physical damage on French soil amount to a violation of the nation’s sovereignty, thus meriting firm responses.
Further emphasizing the severity of the situation, French Foreign Minister Jean-Noël Barrot stated that this incident represents "the first large-scale cyberattack aimed at sabotage on our national territory," posing a significant threat to public safety and national interests.
C4 provided extensive evidence in its report, indicating that the Shahid Kaveh group—also referred to as CyberAveng3rs—was involved in reconnaissance of Schneider Electric industrial control systems. This reconnaissance happened in April, prior to the supermarket attacks, indicating a level of premeditation. During the attacks on October 11 and 12, attackers utilized similar techniques, targeting both supermarket cooling systems and energy and water production facilities.
According to C4, the methodology employed in the supermarket attacks aligned with known Iranian cyber tactics. Notable traces of Farsi were detected in the attack infrastructure, further substantiating the attribution. Additionally, the supermarket attacks seemed to have been announced publicly on a propaganda site linked to Shahid Kaveh on October 13.
This incident isn’t the first time the IRGC has been implicated in cyber operations targeting France. Earlier this year, the European Union sanctioned Iranian firm Emennet Pasargad, thought to be a front for IRGC’s cyber unit, for orchestrating previous attacks, including hacking the satire magazine Charlie Hebdo.
The context of these attacks also hints at geopolitical motivations. Iran may be retaliating against France for perceived support of U.S. and Israeli military operations. Despite opposition to the bombing campaign, France permitted U.S. forces to temporarily utilize its air bases for non-combat operations.
In light of these incidents, U.S. Secretary of State Marco Rubio remarked on the severity of the situation, calling the attackers "sickos" and emphasizing that France’s involvement in the Iran conflict is minimal, thus underscoring the irrational nature of the attacks.
U.S. cybersecurity authorities had already issued warnings regarding Iran’s targeted efforts on operational technology devices, including programmable logic controllers. Such attacks not only pose risks to essential services but could lead to operational disruptions and financial losses across various industries.
The Paris Public Prosecutor’s Office has initiated an investigation into the October cyberattacks and has sought international arrest warrants for key members of the Shahid Kaveh unit. Among those named were commanders Mahdi Lashgarian and Reza Salarvand, alongside Hamid Reza Lashgarian, head of IRGC’s cyber command.
In a diplomatic escalation following the disclosures, the French government summoned Iran’s ambassador. EU foreign affairs chief Kaja Kallas announced that European foreign ministers would discuss the implications of France’s attribution of the attacks in an upcoming meeting. She noted that, should the attribution be confirmed, a robust response would be necessary to counter such acts of cyber aggression.
As cyber warfare continues to evolve, the implications for national security, public safety, and international relations are profound, requiring unified action and vigilance from the nations at risk.