France accuses Iran of October supermarket fridge cyber attack

Supermarkets in several European countries cleared fridges and freezers after a cyber attack remotely switched refrigeration systems to defrost mode, forcing food to be thrown away. In a report by Nick Beake, the BBC said around 40 Delhaize stores in Belgium were hit, along with smaller shops in Luxembourg, Sweden, Ireland, Estonia and the Netherlands. An earlier BBC bulletin named Finland as well and put the Belgian total at about 70. The BBC reported that one store outside Brussels lost about €100,000, more than £80,000, of produce, and that temperatures in Belgian fridges and freezers were raised to 50C.

The attack used the same method as one in France in early October, when hackers turned hundreds of supermarket refrigeration systems to defrost. Cybersecurity agencies in the affected countries tried to establish who was responsible. Channel 4 reported that the National Cyber Security Centre, which is part of GCHQ, said the whole supply chain could be at risk and that it was working with UK companies. Channel 4's technology and science editor Siobhan Kennedy also reported that three meat processing plants in the UK were part of the fridge attack, though no meat was inside the fridges. Channel 5's chief correspondent Tessa Chapman reported that a handful of British meat processing firms were affected.

Dr Richard Horne, chief executive of the National Cyber Security Centre, said businesses had to make different choices or face the consequences. 'When food isn't on the shelves, when lights aren't on, businesses have gone under,' he said. He warned that the UK had done technology on the cheap for decades and that AI-enabled attacks on critical national infrastructure were highly likely within two years. He also named Russia, Iran and China as persistent threats.

According to BBC News, technology reporter Will Guyatt said the vulnerability was well documented and a software fix had been available for over a year. He said the simplest option was to disconnect fridges and freezers from the internet. He said the attack did not appear to be AI, but AI would make it easier to find bugs in software.

Sky News interviewed Alice Taylor, senior digital forensics researcher at Oxford Information Labs. She said many supermarket systems were outdated industrial controls, some with publicly reachable web servers using 'admin' as the username and the device date as the password. She said the attack was simple enough for teenage hackers but could have been state-sponsored. She described the period as 'Black October' for cybersecurity.

On GB News, Ciaran Martin, former chief executive of the National Cyber Security Centre, said it was extremely unusual to face a significant cyber attack with no idea who was behind it. Criminal networks had no money to gain, and glory-seeking hackers had not claimed it. A hostile state was possible, but there was no technical evidence yet. He said the affected systems shared outdated equipment from the Danish company Danfoss and urged organisations to ask whether devices needed to be online at all.

Channel 5's chief correspondent Tessa Chapman reported that the Conservative leader said 'Unconventional warfare is here. Now.' and that the government pointed to its cyber security bill in Parliament. The government said it had full preparedness for a volatile world.

On 9 November, BBC One reported that France had formally accused Iran of the October attack on French supermarkets. The BBC said around 700 food distribution centres were attacked, with tens of millions of euros of food lost. The French foreign minister said the attack was unprecedented in scale and aggression and a major attack on France's national interests and security. France was preparing European sanctions, had summoned Iran's ambassador and opened a judicial investigation into a cyber unit linked to the Iranian Revolutionary Guard Corps. Iran had not responded. It was not yet known whether the French attack was linked to the later attacks across Europe.