When refrigeration systems at hundreds of French supermarkets suddenly failed and food stocks worth tens of millions of euros began to spoil or catch fire, most shoppers probably assumed it was a technical glitch or a sophisticated criminal racket. It was neither. French officials have now formally attributed the operation to an offensive cyber unit linked to Iran’s Islamic Revolutionary Guard Corps. That single attribution changes the tone of the conversation. What once felt like distant geopolitical sparring has landed squarely inside ordinary European life, and the implications keep expanding.
A Pattern That Can No Longer Be Dismissed
I have followed these developments for years, and the latest sequence of events still manages to surprise. The supermarket incident is only the most recent public example. Shortly afterward, a United States indictment described an alleged plot directed against RAF Fairford, the British base that hosts American aircraft and personnel. According to the charging documents, operatives based in Iran coordinated with individuals inside Britain, arranging vehicles, fuel and materials for an attack planned around September. Three men face charges connected to a broader campaign that investigators say involved nearly twenty attacks or attempted attacks across Europe and the United States.
These are allegations that will of course be tested in court. Yet they arrive against a backdrop of repeated intelligence warnings that Iranian services have moved beyond targeting dissidents and opposition figures. Military installations and civilian infrastructure now appear on the target list. That shift matters. It raises the stakes for every European government that once preferred to treat such activity as an inconvenience rather than a direct challenge.
From Cyber Sabotage to Physical Threats
The French case stands out because the damage was so tangible. Hackers manipulated industrial control systems that manage refrigeration. Food spoiled. Fires broke out. Ordinary citizens felt the cost immediately. Officials later named the responsible unit as SHAHID KAVEH, an offensive cyber group affiliated with the IRGC’s Electronic Warfare and Cyber Defense Organization. This was not random vandalism. It was deliberate industrial sabotage carried out on French soil.
Earlier episodes form a longer chain. Iranian-linked actors have been accused of penetrating parliamentary computer systems in Britain, conducting prolonged cyber-espionage against Western universities, launching destructive attacks that forced Albania to sever diplomatic ties, and exposing personal data belonging to readers of a well-known French satirical magazine. Each incident alone could be explained away. Taken together they sketch a sustained campaign.
Physical plotting has run in parallel. A joint statement issued by Britain and more than twenty other countries condemned Iranian intelligence services for lethal plotting against dissidents, journalists and Jewish and Israeli communities. British authorities later publicly accused the Quds Force of directing proxy attacks across the continent and summoned Iran’s diplomatic representative. The alleged Fairford operation fits the same trajectory: harder targets, higher ambition, and less effort to maintain deniability.
A Long Record of Violence on European Soil
None of this emerges from a vacuum. In 1992 four Iranian Kurdish opposition figures were murdered in a Berlin restaurant. A German court later concluded that the killings had been ordered at the highest levels of the Iranian political leadership. In later years dissidents were assassinated in the Netherlands, with Dutch services pointing to strong indications of Iranian involvement. Danish authorities disrupted a suspected assassination plot. The 2018 conspiracy to bomb a large opposition gathering near Paris remains one of the most chilling episodes. An accredited Iranian diplomat based in Vienna allegedly organized the attack; European security services intercepted the plotters before the bomb could reach the venue. The diplomat was later convicted and sentenced to a lengthy prison term.
More recent cases continue the pattern. A former European parliamentarian was shot in the face outside his home in Madrid. Prosecutors linked the attempt to Iran’s campaign against opponents abroad and sought lengthy sentences for several defendants. British domestic intelligence has warned of more than twenty potentially lethal Iran-backed plots against people living in the United Kingdom since 2022. Journalists, dissidents and political opponents have faced threats of kidnapping or murder. The cumulative weight of these cases makes it difficult to sustain the argument that Europe is merely dealing with isolated criminal acts.
Why the Shift Toward Military and Civilian Targets Matters
For a long time many European governments preferred to view Iranian activity as primarily directed at the regime’s own exiles. That framing allowed a degree of political distance. Once the focus expands to military bases and critical infrastructure, the distance disappears. An attack on an airbase that hosts allied aircraft is no longer an internal Iranian quarrel exported overseas. It is a direct challenge to collective security arrangements.
The same logic applies to civilian infrastructure. Supermarket chains are not military targets. They are the everyday systems that keep cities fed. Disrupting them demonstrates both capability and intent. It also tests the resilience of European societies and the political will of their governments. In my experience covering these issues, such tests are rarely accidental. They are designed to probe responses and to create pressure.
Perhaps the most interesting aspect is how openly some of these operations now appear. Earlier campaigns relied more heavily on deniable cut-outs and criminal intermediaries. The current phase still uses intermediaries, yet the attribution by French authorities and the detail contained in the American indictment suggest that operational security has grown thinner. Whether that reflects overconfidence or simply the difficulty of running large-scale campaigns without leaving traces remains an open question.
The Limits of Familiar Diplomatic Habits
European policy toward Tehran has often rested on the belief that dialogue, economic incentives and carefully calibrated pressure could eventually produce a more restrained Iranian posture. That approach has delivered occasional tactical pauses, yet it has not ended the pattern of assassination plots, cyber operations or proxy violence. The regime continues to execute political prisoners at home while projecting force abroad. The two behaviors are not contradictions; they form a coherent strategy of survival through intimidation.
I have heard the familiar arguments for decades: another round of talks will moderate behavior, sanctions relief will create stakeholders for stability, cultural exchanges will soften hard-liners. The evidence keeps pointing in the opposite direction. When a government is prepared to order the murder of opponents on European streets and to sabotage civilian infrastructure, the assumption that it seeks conventional diplomatic accommodation begins to look optimistic at best.
There can be no credible diplomatic settlement while the same leadership continues to sponsor assassination plots, wage cyberwarfare and terrorize opponents abroad.
That observation is not a call for reckless confrontation. It is a recognition that policy built on repeated illusions eventually collides with reality. European governments retain a range of tools short of military action: stronger sanctions on specific entities, deeper cooperation among intelligence services, faster attribution of cyber incidents, and clearer support for Iranian civil society. What they cannot afford is continued pretence that the problem is manageable through the same methods that have already failed.
Practical Consequences for European Security
The immediate practical questions are straightforward. How resilient are industrial control systems that manage food distribution, energy and transport? How quickly can authorities attribute and publicize attacks without compromising sources? How prepared are military installations to detect and disrupt plots that rely on local facilitators rather than sophisticated foreign teams? These are not abstract exercises. They determine whether the next incident produces only economic damage or something far worse.
Coordination among European services has improved, yet gaps remain. Criminal intermediaries can be recruited across borders. Cyber tools travel easily. Proxy networks adapt. Closing those gaps requires sustained investment and political attention that does not evaporate once headlines fade. In my view the supermarket case should serve as a wake-up call precisely because the targets were so ordinary. If refrigeration systems can be manipulated at scale, other control systems can be targeted as well.
- Industrial control systems protecting food supply chains need urgent hardening and continuous monitoring.
- Intelligence sharing on Iranian-linked facilitators operating inside Europe must become routine rather than exceptional.
- Public attribution of cyber operations should occur faster when the evidence meets established thresholds.
- Military and dual-use sites require updated threat assessments that account for hybrid tactics.
- Support for independent Iranian voices and civil society remains a long-term strategic interest.
None of these steps is cost-free. All of them are less costly than absorbing repeated shocks to civilian infrastructure or discovering a successful attack against a military facility after the fact.
What Ordinary Citizens Should Understand
Most people will never encounter the technical details of cyber attribution or the legal intricacies of an indictment. What they will notice is rising prices after food stocks are destroyed, or the sudden appearance of extra security around certain sites, or the quiet departure of diplomatic staff. Those surface effects are the visible edge of a deeper contest. Understanding that contest does not require expertise in every intelligence assessment. It requires recognising that the same regime that represses its own population has shown itself willing to export violence and disruption.
I’ve found that public discussion often swings between two unhelpful extremes: treating every incident as proof of imminent war, or dismissing every incident as exaggerated propaganda. Reality sits in the uncomfortable middle. The threat is real, documented across multiple jurisdictions, and evolving. It is also manageable if governments treat it with the seriousness it deserves rather than hoping it will subside on its own.
The Iranian people themselves remain the primary victims of the system that rules them. Their struggle for basic rights and accountable government is not a sideshow. European policy that pretends otherwise ultimately weakens its own position. Supporting that struggle does not mean endorsing any particular exile faction; it means refusing to grant legitimacy to a leadership that systematically violates the most basic norms of international conduct.
Looking Ahead Without Illusions
The coming months will test whether European capitals absorb the lessons of the supermarket sabotage and the Fairford allegations or simply absorb the next shock. Attribution is necessary but not sufficient. Consequences that raise the cost of future operations are required. Those consequences need not be dramatic to be effective. Consistent enforcement of existing sanctions, rapid expulsion of intelligence officers operating under diplomatic cover, and closer technical cooperation on cyber defence all raise the operational price of continued aggression.
At the same time, societies must improve their own resilience. Food distribution networks, energy grids and transport systems were never designed to withstand state-sponsored cyber campaigns. Retrofitting them will take time and money. The alternative is to accept periodic disruption as a permanent feature of daily life. That is a choice, even if it is rarely presented as one.
I remain cautiously optimistic that clearer-eyed policies are possible. The French decision to attribute the supermarket attacks publicly is one small example. The willingness of multiple governments to issue joint statements condemning lethal plotting is another. Momentum of that kind can build, provided it is not allowed to dissipate once the immediate headlines move on.
The central point is simple enough. A campaign that once concentrated on silencing opponents abroad has expanded to include civilian infrastructure and military sites inside Europe. Pretending otherwise no longer serves any serious purpose. The evidence has accumulated over decades and across many jurisdictions. The only remaining question is whether European governments will finally match their rhetoric about defending citizens and alliances with the practical measures required to do so.
The Human Cost Behind the Headlines
Behind every technical report and indictment stand individual lives. Dissidents who fled repression only to face surveillance and threats in their countries of refuge. Journalists who continue reporting despite intimidation. Families who learn that a relative has been targeted. Ordinary workers who discover that the food they intended to buy has been destroyed by remote sabotage. These human details are easy to lose in discussions of strategy and attribution, yet they are the reason the strategy matters.
European societies have long prided themselves on offering safety to those escaping authoritarian rule. That promise is tested whenever foreign intelligence services operate with relative impunity on European streets. Restoring the credibility of that promise requires more than statements of concern. It requires concrete disruption of the networks that plan and finance the threats.
In the end the choice is not between engagement and isolation. It is between policies grounded in the actual behaviour of the Iranian leadership and policies that continue to hope for a transformation that shows little sign of arriving. The supermarket fires and the alleged airbase plot are only the latest data points. They will not be the last unless the response changes.
Europe has the capacity to defend its citizens, its infrastructure and its alliances. What has sometimes been missing is the clear-eyed recognition that the threat is neither imaginary nor temporary. That recognition is now harder to avoid. The remaining task is to act on it with consistency and resolve.
The story is still unfolding. Each new attribution and each new indictment adds weight to the case that Iranian operations inside Europe have entered a more dangerous phase. Ignoring the evidence will not make the danger recede. Confronting it directly remains the only responsible course.
