France blames Iran's IRGC cyber unit for supermarket fridge hack

Charges and context

The investigation, led by one or more investigating judges, covers fraudulent interference with an automated data processing system by an organised group, and damage by a means dangerous to people, also by an organised group. The Paris prosecutor says the offences were committed to serve a foreign power, in this case Iran.

The unit had reportedly drawn up, some years earlier, a list of potential targets in several Western countries, France included. Among the plans were systems that control heating and ventilation in buildings, which makes an attack on refrigeration controllers consistent with its interests.

Pro-Russian groups also claimed responsibility

Before the French announcement, two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed the attacks on Telegram. They mostly cited stores in other European countries, including Belgium, Germany and Sweden.

As evidence, they published 2,500 lines of data said to come from a directory stolen from Danfoss, the maker of many of the compromised controllers. It is possible the Russian groups simply sought to exploit the situation for publicity: NoName057(16) is best known for DDoS attacks on government sites and media outlets, operations typically meant to make noise.

The case shows how hard attributing attacks on industrial and building systems can be, especially when rival groups claim the same operation. The judicial investigation will now determine whether the suspicions against the Iranian unit hold up.