Update: France blames Iran's Revolutionary Guard for the supermarket fridge hack and promises sanctions

This updates our November 5 report and our November 2 report. The new development: the French government has named a culprit.

France has accused Iran's Islamic Revolutionary Guard Corps (IRGC) of being behind the attack that raised temperatures in supermarket fridges and freezers across the country on October 11, according to the BBC. The accusation is also headlined by AP, the Wall Street Journal and the Financial Times.

What officials said

Foreign Minister Jean-Noel Barrot called the attack "unprecedented in both its scale and its level of aggression" and said the people responsible would face sanctions. France summoned the Iranian ambassador and said it will take "any other necessary and proportionate measures" to deter a repeat, the BBC reported. The Paris prosecutor, Laure Beccuau, said an investigation has been opened into the head of an offensive cyber unit linked to the IRGC, and two deputies. She named the unit as Shahid Kaveh.

What is not known

The BBC reports that the French government has not said how it reached its conclusion, and notes that attributing cyberattacks is very difficult because hackers can hide their location. Iran has not responded officially; some Iranian media called the allegations baseless. Two Russian-aligned hacktivist groups claimed responsibility last week, but few observers believed them, per the BBC. It is also not known whether the French attack and the later wave across Europe are linked, and the August refrigeration failures at US military stores are still under investigation.

The scale, per the BBC

• More than 100 Coopérative U supermarkets and 180 Intermarché and Netto stores were hit on October 11, with Carrefour, Monoprix and E.Leclerc also affected.
• The attack targeted software from the Danish firm Danfoss that lets retailers manage cold units remotely. Some stores reportedly saw temperatures reach 50C (120F) overnight.
• A second wave earlier this month hit more than 100 stores across Europe.

Why owners should care

Naming a state changes the risk picture from criminal nuisance to geopolitics. Anyone who runs a walk-in cooler, a pharmacy fridge or a cold chain on remotely managed controls should assume the same software could be targeted again. Practical steps: a battery-powered standalone temperature alarm, a written plan for moving stock, and a check with your insurer on whether spoilage from a cyber event is covered. The BBC notes Iranian commentators have argued retaliation should reach beyond the Middle East if the US and Israel resume the war; that is context, not a finding about this attack.

Sources: BBC News; headlines from AP, WSJ and the Financial Times; the Chronicle's earlier reports. Attribution of cyberattacks is contested and details may change. This is market information, not investment advice.