Could Iran-linked cyberattacks reach Europe’s homes and critical infrastructure?

LONDON: For a few days, governments around the world clung to the hope that the bizarre series of cyberattacks on supermarket freezers across France was the work of hackers with some kind of societal grudge, or perhaps criminals planning to demand ransom payments.

But the announcement by the French government on Monday that the attack of “unprecedented scale and unprecedented aggression” was in fact the work of Iranian agents suggests a far more ominous scenario.

If the conclusion of the French security services is correct, then US allies around the world could be on the cusp of a devastating cyberwar for which they are ill-prepared, and against which conventional military defenses are utterly helpless.

French retailers were not the only victims of the attacks. The first incident, in mid-October, saw the temperature of hundreds of supermarket fridges across France raised remotely to up to 50 degrees centigrade overnight, destroying large amounts of food.

Then, at the beginning of November, an identical cyberattack hit supermarket chains in seven countries across Europe, including Belgium, Ireland, Finland, the Netherlands and Sweden.

Even more worrying than the loss of perishable food worth millions of euros, on Nov. 1 and 2 the refrigerators at three regional blood banks run by the state French Blood Establishment were also hit.

On this occasion, because the essential supplies are monitored by staff in person around the clock, blood was moved to other refrigerators and saved.

At first, suspicion fell on Russia, which is at odds with many European countries for their support for Ukraine.

But on Monday, France’s foreign minister, Jean-Noel Barrot, was unequivocal. “Thanks to the remarkable efforts of government agencies,” he said, speaking during the G7 meeting in Paris, “I am able to confirm that the Islamic Republic of Iran’s Revolutionary Guards are responsible for this attack.”

He said that in addition to summoning the Iranian ambassador to Paris to “lodge a very strong protest,” France will take “any other necessary and proportionate measures” to respond to the incident and “deter anyone who might seek to repeat it.”

Iran has dismissed the French accusations as “baseless and hostile.”

The Paris public prosecutor said that government agencies had uncovered “the use of Farsi and IP addresses traced back to devices located in Iran,” in attacks which had all the hallmarks of an Iranian cyber warfare unit called Shahid Kaveh.

Shahid (or martyr) Kaveh was named after Mohammad Kaveh, a commander of Iran’s Islamic Revolutionary Guard Corps who was killed in 1986 during the Iran-Iraq War.

In July 2025 the unit was the subject of an investigation by DomainTools, a US cybersecurity company. This identified a sub-unit within Shahid Kaveh called Intelligence Group 13, which it described as “one of the most operationally aggressive and ideologically fortified units within the IRGC cyber arsenal.”

The DomainTools investigation even identified and named two Shahid Kaveh officials, including Hamid Reza Lashgarian, the head of Shahid Kaveh, for whom France has now issued an international arrest warrant.

Intelligence Group 13, it added, was “already known for its history of intrusions into critical infrastructure,” and DomainTools delivered what may yet turn out to have been a prescient warning.

Capable of delivering “retributive action through cyberspace,” further campaigns by the group, it predicted, were likely to include “threatening or disrupting civilian infrastructure in the US, Israel and the Gulf states.”

For Iran, hard pressed by sanctions, the appeal of such asymmetric warfare is obvious — a cheap but devastating cyberattack can potentially cause far more damage and disruption than any number of expensive drones or missiles — and governments around the world are now scrambling to react to this new form of hybrid warfare.

On Nov. 5, the US Cybersecurity and Infrastructure Security Agency, the FBI, and the departments of health, transport and agriculture jointly published a fact sheet, warning operators of “critical infrastructure” to “strengthen industrial refrigeration and cold-chain monitoring systems cybersecurity.”

Chris Butera, acting assistant director for cybersecurity at CISA, said it was “actively tracking this threat activity. Every organization that depends on refrigeration and monitoring systems should assume it could be a target.”

It is not only supermarket freezers at risk from such attacks. Industrial refrigeration and cold-chain monitoring systems, CISA said, are “critical to multiple industries from healthcare to chemical production, food and agriculture, and transportation.”

Danielle Cosgrove, a senior adviser to the Atlantic Council’s counterterrorism project, believes further attacks can be expected, and not limited to France.

“What particularly concerns me is the potential for simultaneous or cascading disruptions,” she told Arab News. “Imagine multiple hospitals, water facilities, transportation systems or food distribution centers experiencing unexplained failures at the same time.

“Individually they’re manageable, but collectively they strain emergency services, disrupt supply chains and physical services on which entire communities and economies depend.”

Cosgrove believes France may have been targeted because “there's been a deterioration in relations between Europe and Iran, and the EU has significantly expanded sanctions against Iran this year.”

Also, in September France announced it was sending troops and equipment to Saudi Arabia to help defend the strategically important Red Sea oil port of Yanbu from missile attacks by the Iran-backed Houthis in Yemen.

For cybersecurity firms and national security agencies racing to identify and protect potential targets, in our super-interconnected world the task is overwhelming.

Domestic targets of disruptive attacks could include “smart” devices, such as Alexa speakers, security cameras and home-management systems controlling lighting and heating.

More seriously, disruption targeted at internet-connected vehicles, many of which now have semi-automated features such as steering and braking overrides, could prove fatal — potentially, on a mass scale.

So-called denial of service attacks on cellphone and radio networks could cripple emergency responses by police, fire and ambulance services.

In a recent report the Cyber Monitoring Centre warned that three of the UK’s most critical sectors — health, transport and finance — are reliant upon and “highly exposed” to the cloud. Most countries are equally exposed.

Electricity and water supplies, hospital systems and even medical devices are considered particularly vulnerable.

On Nov. 5, the US Food and Drug Administration issued a warning that “medical devices can be vulnerable to cybersecurity threats, potentially impacting the safety and effectiveness of the device” and issued “tips to keep your medical device secure.”

According to an advisory issued in June by IEEE, the US technology standards association, “the transformation of healthcare through connected medical devices ... carries substantial cybersecurity implications that extend far beyond traditional IT security concerns.”

Devices which rely on wireless or networked connectivity considered vulnerable to cyberattacks include pacemakers, insulin pumps, cardiac defibrillators and infusion pumps.

These concerns multiply when applied to mass-transport systems, from trains to aircraft.

There is still no adequate explanation for the multiple emailed bomb threats that were received by airlines across Europe last week, affecting flights to or from more than a dozen countries.

Another vital piece of European infrastructure at risk is the digital border Entry and Exit System, introduced this year by the European Union. So far, with multiple technical glitches in the wake of its introduction, the system appears to have been self-sabotaging, leading to enormous queues at airports and causing thousands of passengers to miss their flights over Europe’s busy summer period.

In some cases, the cost for individuals has extended beyond inconvenience. On Tuesday it was reported that some travelers from Britain, which is now out of the EU, have been blocked from returning to Europe and issued with large fines because the system failed to record their entry to and exit from the bloc correctly.

So far, although European prosecutors have reportedly investigated Russian links to one of the software companies involved in the system, the EU agency responsible for border controls insists the system has not been breached by bad actors, but the potential for widespread disruption caused by malicious hacking is obvious.

In addition to being defenseless when it comes to protection from digital attacks, expensive conventional weapons systems are also considered as being on the list of vulnerable targets.

On Sunday, the commander of the UK’s recently established Defense Cyber and Electromagnetic Force revealed that specialist “hunt forces” were operating overseas in a bid to foil cyber operations.

“We are trying to hunt for our adversaries in places where they prepare before they target UK military systems,” Maj. Gen. Mike Fayers told The Times of London.

The wave of attacks on fridges and blood banks across Europe, he added, “shows you the scale and the speed of the challenge we face in the cyber domain.”

It is a challenge to which the UK government has reacted over the past month by advising citizens to stock up on three days' worth of emergency supplies, from tinned food and water to batteries and wind-up radios, to prepare for an unspecified “difficult situation.”

During a radio interview on Oct. 23, Andy Burnham, the prime minister, said “it’s not about panicking ... It’s about just taking sensible measures to have enough in the house to tide you over should there be a difficult situation.

“Unexpected events,” he added, “seem to be becoming more and more common.”

A government website, “Be ready for emergencies,” lists “some simple and effective steps you can take to be ready for emergencies and the disruption they cause,” and offered a downloadable “Be Ready Checklist.”

Predictably, UK supermarkets reported panic buying of many of the items on the list.