France has formally attributed a cyber-attack on supermarket refrigeration systems to hackers operating under Iran's Islamic Revolutionary Guard Corps. Some freezers had temperatures raised so high they caught fire; employees dumped spoiled meat and melted ice-cream into bins. France's foreign minister called it an act of "unprecedented scale and unprecedented aggression" and pledged Europe-wide sanctions against those responsible. The attack was not technically impressive. Hackers used default passwords to access fridge controls — the digital equivalent of walking through an unlocked door. Rafe Pilling, a senior director at cybersecurity firm Sophos, said the low sophistication was consistent with Iranian capabilities and that a presumption now exists linking the French attacks to a broader wave of rogue defrosting hacks across Europe. Iran's cyber doctrine is distinct from its peers. China focuses on industrial espionage and mass data harvesting. Russia targets infrastructure disruption and disinformation. North Korea hacks crypto exchanges because it needs cash. Iran, by contrast, uses cyber operations to project power and signal political displeasure — a digital shot across the bow. The 2023 deepfake broadcast interrupting UAE streaming services and the hijacking of Israeli-made water-control equipment to display "down with Israel" fit the same pattern. The fridge attacks follow a clear escalation sequence: industrial freezers at an Israeli food production plant were hit in May, then food spoiled at US military bases in August in incidents now treated as suspected hacks. Neither has been officially attributed to Iran, but the French announcement is the first to formally implicate the IRGC in this category of attack. The target set — Israel, US military, European retail — maps neatly onto Iran's adversary list. The UK's National Cyber Security Centre warned the country is in the "foothills" of a new threat level, expecting a "huge rise" in incident volume. The centre's main concern is AI's capacity to identify previously unforeseen flaws in IT systems and help attackers plan operations. But the fridge hacks didn't need AI — they needed nothing more than manufacturers' failure to change default credentials. This is the core problem the story exposes. Operational technology — fridges, water systems, HVAC, industrial controls — was designed for reliability, not security. These systems were never meant to face the internet, but connectivity was bolted on without hardening. The attack surface is enormous, the defenses are trivial, and the consequences scale from spoiled food to critical infrastructure failure. The geopolitical overlay makes this worse, not because Iran's hackers are elite, but because they don't need to be. When default passwords protect temperature-critical systems in supermarkets, hospitals, pharmaceutical storage, and food supply chains, the barrier to disruption is effectively zero. The question is not whether more attacks will come but whether the industrial world will secure its control systems before someone targets something that matters more than ice-cream.
