France has now officially accused Iran of carrying out the massive cyberattack that crippled refrigeration systems across hundreds of supermarkets in October. What began as a seemingly bizarre incident involving refrigerators has become a matter of national security. French Foreign Minister Jean-Noël Barrot announced on November 9 that investigators had traced the sabotage to a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The attack affected approximately 700 supermarkets, destroyed enormous quantities of food, and caused tens of millions of euros in losses. Similar incidents have since appeared across Europe, including attempts to compromise refrigeration systems used to preserve blood supplies. The French government is now treating the original attack as an act of foreign sabotage, while European officials are preparing a coordinated response.
I have warned that cyberwarfare would eventually move beyond stealing passwords, financial records, and government secrets. We are now witnessing attacks on the infrastructure that keeps modern society functioning. The attackers did not need to destroy a supermarket or bomb a warehouse. They accessed computerized temperature controls and turned refrigeration equipment into a means of destroying the inventory it was supposed to protect. That is a significant development in the economic consequences of cyberwarfare.
During the October 11–12 attack, hackers remotely manipulated refrigeration controllers, pushing temperatures as high as 50°C (122°F), for approximately six hours. Major French supermarket chains, including Carrefour, Intermarché, Monoprix, and Coopérative U, were affected. At least 15 fires were reported in connection with the sabotage, and Intermarché alone reported losses running into tens of millions of euros.
French investigators identified the Shahid Kaveh cyber unit, also associated with the name CyberAv3ngers, as the suspected operator. Authorities cited Persian-language traces, internet addresses associated with Iran, and methods previously linked to the group. French prosecutors have sought international arrest warrants for the unit’s leadership and deputies. Barrot summoned Iran’s ambassador and announced that France would pursue European sanctions. Tehran has rejected the allegations as baseless and hostile.
The attacks did not remain confined to France. During the first days of November, refrigeration systems at supermarkets in Belgium, Luxembourg, the Netherlands, Ireland, Sweden, Estonia, Finland, and other European countries experienced similar disruptions. Italian authorities also reported incidents involving food-distribution businesses, including a catering company in Tuscany and a frozen-food producer in Emilia-Romagna. Italy’s national cybersecurity agency issued urgent warnings to the food industry and called for immediate protective measures. The Italian cases and the broader European incidents have not all been conclusively attributed to the same perpetrators. Nevertheless, the geographical spread demonstrates how a vulnerability in widely used industrial equipment can become a problem for an entire continent.
The attacks on blood bank refrigeration systems should concern everyone. French blood storage facilities were targeted by attempts to manipulate temperatures, but the French Blood Establishment reported that the attacks were stopped before blood products were spoiled. The attempted sabotage reveals the potential consequences. Blood, plasma, medicines, and certain medical materials require carefully controlled storage conditions. A compromised refrigeration system can threaten supplies that hospitals depend upon for emergency treatment, surgery, and routine care. We are discussing the vulnerability of essential medical infrastructure.
Italy was among the first governments to recognize the broader implications. Foreign Minister Antonio Tajani specifically requested that the November 9–10 G7 meeting in Paris address the escalation of hybrid warfare targeting Europe. Italy’s Foreign Ministry identified attacks involving air traffic, supermarkets, and blood transfusion centers as threats intended to spread panic and disrupt daily life. Tajani called for a coordinated international response. This is a significant escalation from treating the incidents as isolated technical failures. Europe’s political leadership is now discussing them in the context of hostile operations against civilian infrastructure.
EU foreign policy chief and neocon darling Kaja Kallas has also indicated that cyberattacks will be discussed at the Foreign Affairs Council meeting on November 16. On November 10, the European Commission expressed solidarity with France and said it was prepared to coordinate a response with member states. However, the EU has not independently attributed every attack across Europe to Iran. France has formally blamed the IRGC for the October attacks on its territory, while investigations into the subsequent incidents continue. That distinction matters because the political consequences of blaming a foreign government are considerably greater than those of identifying a criminal hacking group.
We have also seen cyberattacks attributed to Iranian-linked groups targeting American water infrastructure and other industrial systems. The Shahid Kaveh group has previously been associated with attacks on internet-connected industrial controllers. These systems are attractive targets because they operate essential physical processes but are often connected to networks designed primarily for convenience and remote management. The danger is that an attacker does not need to gain control of an entire electrical grid or hospital network to inflict serious damage. Compromising a single category of equipment used across thousands of facilities may be sufficient to cause widespread disruption.
There is another implication that European leaders must consider. NATO has explicitly recognized that a sufficiently severe cyberattack could constitute an armed attack under Article 5 of the North Atlantic Treaty. The decision would be made by the alliance on a case-by-case basis, considering the scale and consequences of the incident. A cyberattack that caused widespread deaths, disabled hospitals, contaminated water supplies, or crippled a nation’s electrical infrastructure could raise the question of collective defense even if no conventional weapons were used. Article 5 would not automatically require every NATO member to launch a military attack, but it would obligate allies to provide assistance through measures they deemed necessary. The current refrigeration attacks have not triggered Article 5, and there is no indication NATO has determined that they meet that threshold. Nevertheless, France’s formal accusation against Iran raises an uncomfortable question. If a more destructive cyberattack occurs, will European governments treat it as criminal sabotage, an act of war, or grounds for invoking collective defense? The distinction could determine whether a cyber incident remains a diplomatic dispute or becomes another route toward a much larger military confrontation.
We are entering an era in which the boundary between economic warfare and military warfare is becoming increasingly difficult to define. A hostile government can inflict substantial economic damage without deploying troops or firing missiles. The attacks against Europe’s refrigeration systems demonstrate how ordinary commercial equipment can become an instrument of geopolitical confrontation. France has now identified what it believes to be a state-sponsored operation, Italy has pushed the issue onto the G7 agenda, and Brussels is considering a coordinated response. The next challenge will be determining how to defend civilian infrastructure without allowing every cyber incident to become another justification for military escalation. Europe is already confronting enormous economic and security pressures. A conflict that spreads into its food supply, medical systems, and essential utilities would make those problems considerably more difficult to contain.