The first sign, in the accounts French officials have assembled, was temperature. Display cases in a supermarket chain’s cold rooms began drifting out of range overnight, then compressors shut down. Somewhere else in the same campaign, a blood bank’s storage units reported readings that would have ruined their contents had staff not moved them.
On November 10 the French government said the cyber unit of Iran’s Islamic Revolutionary Guard Corps was behind the operation, which it described as an intrusion into internet-connected temperature-control equipment at food retailers and medical facilities. Officials put the damage in the millions of euros and said Paris is assessing sanctions options.
The targets were not databases or email servers. They were thermostats, controllers and building-management systems: the unglamorous hardware that keeps vaccines cold, blood viable and frozen food frozen. The attacks produced temperature irregularities and shutdowns across food retail and health care, according to the government’s account.
That choice of target is what makes the case notable. Operational technology, the gear that touches the physical world, has been the part of the estate security teams understand least. These devices are often installed by contractors, connected to the internet for remote maintenance, and left running with factory default credentials for a decade. Patching them requires a truck, not a download.
France’s cyber agency, ANSSI, has spent years warning about exactly this. Its annual threat reports have flagged attacks on small municipalities, hospitals and water utilities, and it has published guidance urging operators to isolate building systems from the open internet. The warnings were largely unheeded because the equipment works, and because replacing it is a capital expense with no visible return until something breaks.
Attribution to the Revolutionary Guard places the incident in a pattern Western governments have been documenting for several years. Groups tracked by researchers as Iranian-affiliated, among them one calling itself Homeland Justice, have been linked to destructive attacks on Albanian government systems and to intrusions at Israeli water and municipal infrastructure. Those campaigns mixed espionage with the deliberate signaling that comes from causing visible disruption.
The French statement is a step beyond what most governments have been willing to say in public. Formal attribution of an operational-technology attack to a state military body, with a specific unit named, is rare, and it usually precedes a policy response. Paris said it would evaluate sanctions, which in the European context means the bloc’s cyber-diplomacy framework, in place since 2020, that allows asset freezes and travel bans on individuals and entities.
Sanctions are a weak instrument against a military organization that holds no Western assets. Their value is political: they name the behavior, complicate the target’s ability to buy equipment and travel, and give allies a framework to join. Whether other European capitals follow will depend on their own breach assessments, which in most cases remain classified.
The more consequential question is regulatory. Critical-infrastructure rules in Europe have focused on large operators, energy grids, hospitals above a certain size, water utilities. A supermarket chain with 400 stores and a regional blood service may fall below the thresholds that trigger mandatory security audits, even though both hold physical processes that can be attacked remotely. Officials have begun to acknowledge the gap without agreeing on how to close it.
For the retailers and health providers affected, the immediate work is unglamorous: inventory the devices, change the passwords, segment the networks, remove remote-access ports that no one remembers opening. Vendors of building-management systems have been criticized for years over hard-coded credentials and unencrypted protocols, and some have begun shipping locked-down firmware. The installed base, which numbers in the millions across Europe, will take a decade to turn over.
Europe’s own rulebook is catching up unevenly. The NIS2 directive, which member states were meant to transpose into national law, expands cybersecurity obligations to food distribution, waste management and health providers, and it requires incident reporting within 24 hours. Transposition has been slow, and the thresholds still lean on company size rather than on what a company’s equipment can do to a physical process.
Insurance is another pressure point. Policies that cover business interruption typically exclude cyber causes unless a cyber extension is bought, and many mid-sized retailers never bought one because their broker’s questionnaire asked about data breaches. A claim for spoiled inventory and lost trading days after a thermostat attack may land in a gap between two policies, which is a dispute that will be resolved after the fact by lawyers reading definitions.
What the French case does not yet answer is scale. “Millions of euros” covers a great deal, from a few hundred spoiled pallets to a regional distribution failure. Officials have not published the number of sites affected, the duration, or whether any clinical operations were interrupted. Nor have they said what the attackers were after, if anything beyond disruption.
Those gaps matter because the next incident will be judged against this one. If a state military unit can reach into supermarket freezers and blood-bank refrigerators, the perimeter that governments have spent two decades building around data has an unlocked service door in the basement. The audit that follows, in France and elsewhere, will show how many other buildings have the same door open.
