From Spoiled Food to Evacuated Airbases: New Iran-Linked Security Alarms Hit France and Britain
France on Monday accused Iran’s Revolutionary Guards of responsibility for cyberattacks that knocked out commercial refrigerators and freezers across the country last month, saying there would be consequences for Iran. The same day, the Wall Street Journal reported that the US military had evacuated aircraft from a second airbase in Britain after a threat from Iran.
French Foreign Minister Jean-Noël Barrot said the Iranian ambassador had been summoned to France’s foreign ministry. He also threatened further EU sanctions against Iran. Iran’s mission to the United Nations did not return messages seeking comment, according to Reuters. Iran routinely denies carrying out malicious cyber operations.
The announcement came only minutes after Reuters revealed that investigators privately suspected Iran of being behind the attacks. Microsoft had privately tied Iran to the October cold-storage sabotage at least two weeks ago, according to three people familiar with the matter. The company declined to comment.
The hacks struck hundreds of French supermarkets in early October and were among the most disruptive cyberattacks of the Iran war, which began in February. The conflict has been marked by scattered incidents of alleged digital disruption, including hacks against the Los Angeles transit system in March, US water treatment plants in July and ships bound for the United States in August.
The effects of the October 11 attacks were dramatic. Some refrigerators had their temperature turned up so high that they caught fire. Supermarket employees carted boxes of perished meat and melted ice cream into giant trash containers in the hours that followed. One French supermarket owner estimated that the total cost could add up to tens of millions of euros nationwide.
A second wave of hacking this month hit more than 100 establishments across Europe. It even affected refrigerators used by French blood banks, forcing employees there to move some of the blood to different cold storage units.
Report names alleged Revolutionary Guards unit
In a joint report issued by French spy and cyber agencies, officials accused Shahid Kaveh, described as a cyber offensive unit tied to the Revolutionary Guards, of being behind the campaign. They named three alleged associates: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand. Reuters said it could not immediately locate contact details for the men, whose photographs were included in the report.
The report said the hackers worked through numerous front groups masquerading as vigilante hackers, including “CyberAveng3rs” and “Cyber Isnaad Front”. It said a total of 700 commercial sites had been targeted across France and that at least 15 fires had broken out. Most of those affected were supermarkets, but small butcher stores, a slaughterhouse and factories processing foodstuffs were also hit. Paris prosecutors said in a separate statement that they had requested international arrest warrants for the perpetrators.
French authorities said they linked Shahid Kaveh to the attacks in three ways: by tying the incidents to the digital infrastructure used to sabotage the fridges, by matching the intrusion pattern to other hacks carried out by the unit, and by recovering traces of Farsi in the attack infrastructure.
The sabotage of European supermarket fridges was preceded by at least one similar incident in the United States. In August, refrigerators in at least six military commissaries went out of commission. Pentagon investigators are treating the malfunctions as a suspected cyberattack and are working with French officials, Reuters reported last month. A person familiar with the matter said the Pentagon considers Iran a suspect but that the investigation is still in progress. Reuters said it could not establish how the military made its determination or whether it was also looking into other suspects. News website Nextgov first reported last month that the US military considers Iran a suspect.
The Pentagon said on Monday it was “aware of speculation regarding a potential cyber incident” but could not offer further comment for security reasons.
Iranian hackers have allegedly struggled previously to pull off hacks that trigger widespread disruption. The freezer sabotage was a notable exception, and this week it prompted warnings from US officials that more could be coming. Cybersecurity experts previously told Reuters the hacks appeared to have been easy to carry out. The firm behind many of the affected units said several were obsolete or running outdated firmware, which could have made it easy for hackers to break in. Saher Naumaan, a senior threat researcher at the cybersecurity company Proofpoint, said in an email that the sabotage was less a measure of Iran’s cyber prowess than of “how exposed these systems are.”
US Moves Aircraft From Second UK Base
Separately, the US military evacuated aircraft from RAF Mildenhall on Monday after a threat from Iran, the Wall Street Journal reported, citing people familiar with the matter. Two US refueling tankers using the base diverted to Germany earlier in the day, and several other tankers were later moved to Germany and other locations. According to the Journal, the precise nature of the threat remains under discussion among US officials.
“We do not routinely comment on the activity of other nations. Aircraft and other assets move regularly according to operational requirements,” a British ministry of defense spokesperson said. The Pentagon and the US European Command did not immediately respond to a Reuters request for comment sent outside regular business hours.
The move comes weeks after the US withdrew its B-1 bombers from RAF Fairford on security grounds, following a suspected Iran-linked security incident. Five men were arrested outside the base in southwest England in September, and two others were arrested later on suspicion of assisting Iranian intelligence. The circumstances remain largely unexplained but attracted huge international attention, coming at a time of heightened concern about the security implications of the US-Iran war for Western states. RAF Fairford had been used by US bombers to carry out strikes on Iran.
British Prime Minister Andy Burnham said last month that the activity at RAF Fairford was likely to have been coordinated in Iran. Tehran’s ambassador to Britain has denied this.
