Officials in France on Nov. 9 claimed that the Iranian government was behind the cyberattacks on more than 700 French grocery stores that caused massive financial losses, spoiled food inventories, and caused at least 15 fires.
French authorities made the attribution in a five-page report released by the country’s Cyber Crisis Coordination Centre.
The report said the threat actors are part of Shahid Kaveh — also known as the Cyber Av3ngers — the Iranian cyber unit that’s been linked to 2023 attacks on U.S. water facilities, though they have not yet been tied to last summer’s attacks on U.S. water systems.
These attacks on internet-exposed controllers on refrigeration systems as they defrost have also happened across multiple other European countries and are suspected to have affected at least six food commissaries at U.S. military bases domestically. Both the FBI and CISA issued a warning to U.S. critical infrastructure organizations late last week to start locking down their cold refrigeration systems.
"France’s attribution should add urgency for teams here in the U.S.,” said Harry Thomas, co-founder and CTO at Frenos. “Changing a refrigeration controller’s settings can mean spoiled food, damaged equipment, and fires. Operators need to treat these systems as a serious cyber risk.”
Thomas said it now appears that cyber will remain Iran’s preferred option over direct military action for this kind of disruption in the near term: it offers a way to hit supply chains and create physical consequences while leaving responsibility uncertain, at least initially. Attribution can come later, as France has just shown.
John Gallagher, vice president at Viakoo, said attribution of these attacks represents an important step, but it’s more important for organizations to take action to improve their OT/IoT security posture.
“Nothing in the attack vector was unique to nation-state actors,” said Gallagher. “In fact, less than usual in that no malware was created or significant recognizance had to be performed. The controllers were internet-exposed and easy to gain access to normal controls such as the defrost cycle.”
Gallahger pointed out that copycat attacks are still a major threat, given the lack of sophistication of these breaches. The industry needs to make an urgent effort to update and maintain firmware on the latest level, to regularly rotate strong passwords, and to use certificates to determine device authenticity.
“Typically, cyberattacks do not widen into kinetic wars,” said Gallagher. “All conflicts over the last 20 years have had some cyber component to them. However, we are now in a different era in cybersecurity, where attackers are not going after data, but instead operational systems that can cause real-world damage and harm to people. At what point will cyberattacks be no different in their physical impacts than bombs and armored vehicles? We're not there yet but heading in that direction as civilian lives become affected.”
Gary Barlet, Public Sector CTO at Illumio, added that the industry needs to start rethinking its definition of a kinetic attack.
Make no mistake, this was an attack with serious physical impact," said Barlet. "Cyberattacks have always been a gray area. It’s time to start treating these attacks as the real attacks they are, no different from a bomb or missile attack,” said Barlet. “Until these attacks are addressed directly, they will definitely continue. Countries need to be forced to rethink their aggressions in cyberspace and understand they will face real consequences.”
John Strand, owner at Black Hills Information Security, said armies run on their stomachs: destroying food supplies remotely gives the enemy a tremendous advantage.
“And when people lose access to fresh water or the ability to flush their toilets, the disruption goes well beyond an IT problem,” said Strand. “Basic services start breaking down, and society starts feeling it very quickly. We have to look at these systems and identify what’s exposed to the outside world. That includes equipment nobody thought of as a security concern when they plugged it in.”
