Opinion: Iran's supermarket sabotage shows the West still has no answer for hybrid war

On Monday, France's Foreign Ministry did something governments rarely do on a matter of national sabotage: it put a name to the attacker, in public, with specifics. In a formal declaration, Paris attributed an overnight cyberattack that disabled refrigeration controllers at more than 700 supermarket sites across France to a unit called Shahid Kaveh, which it linked directly to the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps. The attack, carried out on the night of October 11-12, caused fires, spoiled tens of millions of euros' worth of food, and did what the ministry called unprecedented damage to the safety of French citizens. France summoned Iran's ambassador the next morning. Iran's foreign ministry called the accusation baseless.

It would be easy to file this under the long, grim ledger of state-sponsored mischief and move on. That would be a mistake. What happened to French supermarkets is a preview of where an unresolved war is heading, and the response to it shows just how unprepared Western governments remain for a form of conflict that no longer announces itself with missiles.

A Supply Chain as a Battlefield

The timing is not incidental. The attack landed eight months into the stalemate that followed the United States and Israel's February strikes on Iran, a war that killed thousands and has since settled into an uneasy, frequently violated truce. Analysts tracking the pattern describe a shift from military targets back toward Iran to civilian infrastructure spread across European territory. French officials' own joint technical report, compiled with the national cybersecurity agency ANSSI and France's domestic and foreign intelligence services, frames the Shahid Kaveh campaign as part of a broader, persistent pattern of Iranian destabilization efforts on French soil, including earlier operations against media outlets and the 2024 Paris Olympics.

France was not alone. Similar intrusions into retail and commercial systems were reported in at least eleven other European countries around the same window, alongside a parallel campaign of propaganda videos threatening American and British air bases. None of this required a missile, a soldier, or a declaration of war. It required a vulnerability in commercial refrigeration software and a willingness to burn food instead of buildings.

That ought to concentrate attention. A food supply chain is not a glamorous target, but it is an intimate one: it reaches into ordinary life in a way that a bombed air base does not. Sabotaging it is also a nearly risk-free way to signal reach and resolve without crossing a threshold that would trigger a conventional military response. If the lesson Tehran drew from eight months of stalemate is that attacking a supermarket chain carries less cost than attacking an air base, that lesson will be tested again, somewhere else, on something more essential than frozen vegetables.

The Diplomatic Theater of Deterrence

What did the West actually do about it? France summoned an ambassador and said it would propose new European Union sanctions, while also reserving the right to take unspecified "public or non-public" countermeasures. Within forty-eight hours, Canada separately reimposed sanctions on eleven Iranian entities, including the National Iranian Oil Company and Bank Melli, over Iran's nuclear and missile programs, a measure framed around nonproliferation rather than the supermarket attack specifically, but one that landed in the same week and the same diplomatic current.

"A persistent threat to our critical infrastructure," is how France's own declaration describes the unit it blames, language that reads less like a warning to Tehran than an admission of an unsolved problem.

Here is the uncomfortable part: this is not the first time. The entity the EU and France had already sanctioned for a comparable cyber intrusion, an Iranian firm once known as Net Peygard Samavat and more recently as Emennet Pasargad, was added to the European Union's cyber sanctions list in March, months before the supermarket attack. Sanctioning that one firm plainly did not deter the next operation. Canada's own sanctions list against Iran has grown for years and now stretches back to measures first lifted a decade ago and then restored. Each new designation is justified, defensible, and almost certainly necessary. None of it, on the evidence of the past year, has changed Tehran's calculus about the cost of sabotage.

That is the real story here, and it is a story about the gap between the tools Western democracies reach for and the tools that would actually raise the price of this kind of attack. A sanctions list is a ledger of accountability after the fact. It is not, by itself, a deterrent, because the people designing and launching these operations were never going to vacation in Toronto or bank in Paris. An ambassador summons is a diplomatic ritual that signals seriousness to a domestic audience more than it imposes any cost on the government being summoned.

What Actual Deterrence Would Require

None of this argues for military retaliation over a hacked walk-in freezer, that would be a wildly disproportionate response to a campaign explicitly designed to stay below that threshold, and reacting to provocation with escalation is exactly the trap Tehran may be testing for. But the current toolkit is not working, and pretending otherwise invites a repeat performance against something harder to replace than lettuce. Three adjustments would matter more than another sanctions announcement: treating operational technology in commercial critical infrastructure, refrigeration, water, retail logistics, with the same mandatory security baselines now required of power grids and telecoms under Europe's NIS2 directive; building a standing, multinational attribution-to-sanctions pipeline so the EU, UK, Canada and the United States can jointly designate and freeze assets within days of an attack rather than months; and stating clearly, in advance, that sabotage of civilian life-sustaining infrastructure will be treated as a category above routine cyber-espionage, with consequences that scale accordingly.

None of that is dramatic. It is also, notably, not what has been offered this week. France's declaration promises sanctions proposals and vague additional measures. Canada's sanctions, welcome as they are on nonproliferation grounds, were calibrated for a different problem and announced on a schedule set by diplomacy, not by the attack itself. The gap between the seriousness of the language, unprecedented, a persistent threat, unacceptable, and the modesty of the response is the story. Tehran's shadow war did not start with the supermarkets, and on the current trajectory, it will not end there either. The question worth asking in Washington, Brussels and Ottawa this week is not whether this attribution was correct. It almost certainly was. It is why, a full war and multiple rounds of sanctions later, the response to sabotaging a nation's food supply still looks so much like the response to everything that came before it.