On October 11-12, a cyber unit affiliated with Iran's Islamic Revolutionary Guard Corps — identified by French prosecutors as Shahid Kaveh — remotely accessed refrigeration systems across France's five largest supermarket chains and cranked temperatures to 50°C overnight. The result: millions of euros in spoiled food, melted equipment, and in some cases, fires. France has now issued international arrest warrants for the unit's leader and two deputies, summoned the Iranian ambassador, and promised EU-level sanctions. The attack hit E-Leclerc, Intermarché, Carrefour, Monoprix, and Coopérative U. At least 300 Intermarché and Netto stores were affected, more than 100 Coopérative U locations, 80 Carrefour outlets, and roughly 5 percent of Monoprix's 490 stores. This was not a data breach or ransomware play — it was physical sabotage through digital means, targeting the unglamorous backbone of the food supply chain. Foreign Minister Jean-Noël Barrot called it "the first large-scale cyberattack carried out for sabotage purposes on French soil" and described the aggression level as "unprecedented." Investigators traced the intrusion to Farsi-language tools and IP addresses linked to devices in Iran. The IRGC's Shahid Kaveh unit is now the subject of international arrest warrants from the Paris prosecutor's office. The attack didn't stop at France. On November 2, supermarkets in Belgium, Estonia, Ireland, Luxembourg, and Sweden reported identical overnight temperature spikes. Dozens of stores and at least one food distribution hub were hit. The geographic spread suggests either a single coordinated campaign or a replicated playbook — either way, it demonstrates that the vulnerability is systemic across European retail, not a French-specific oversight. The core exposure here is industrial control systems — specifically, internet-connected refrigeration — that were never designed with state-level adversaries in mind. Supermarket cold chains were digitized for efficiency: remote monitoring, automated alerts, centralized temperature management. Nobody war-gamed a scenario where a nation-state would treat a Carrefour freezer aisle as a military target. The attack surface was created by convenience, and the defense posture assumed the threat model of a disgruntled employee, not the IRGC. France's response — sanctions, arrest warrants, ambassador summoning — follows the diplomatic playbook. But the structural question is whether Europe will treat food-chain operational technology as critical infrastructure requiring the same cybersecurity standards as energy grids or water systems. Right now, supermarket refrigeration sits in a regulatory no-man's-land: too industrial for consumer data-protection rules, too commercial for national-security cyber mandates. The twenty-year read is uncomfortable. If internet-connected operational technology in retail, logistics, and food processing remains undefended at the perimeter, this attack becomes a template. The IRGC demonstrated that you don't need to bomb a country's food supply when you can spoil it remotely, cheaply, and deniably. The cost asymmetry — pennies of compute versus millions in destroyed inventory — is the signature of a weapon that will be used again.
