Argue about who did it if you like. The more damning fact is how easy it was.
French prosecutors say an Iranian unit called Shahid Kaveh logged into the online interfaces of refrigeration equipment at roughly 700 grocery locations, ran prolonged defrost cycles and switched off the safety alarms. Blood-bank refrigeration was reportedly targeted too, though nothing was damaged. No missile, no malware masterpiece. By the prosecutors' account, someone walked in through a web portal that never should have faced the open internet.
That is not an act of God. It is a business decision, made thousands of times over. Remote-access refrigeration controls are cheap to run, convenient for maintenance contractors and profitable for vendors. Security costs money and appears nowhere on a quarterly earnings slide. So it gets skipped, and the risk is pushed onto everyone else: the shopper, the night-shift stock clerk who throws out pallets of spoiled food, the small supplier whose product is in that freezer, the public health system that depends on cold chains it doesn't control.
We should also be honest about the attribution. Persian-language use and Iranian IP addresses are the kind of evidence any competent operator can fake or any criminal can borrow. Prosecutors say they have more, and a judicial investigation naming a unit leader and two deputies is the right venue for testing it. Those of us who remember how confidently governments once spoke about Iraqi weapons have every right to say: show the work. Nobody should let an unproven allegation become a pretext for escalation against Tehran. Cyber conflict is a bad place for guesswork, and a worse one for flag-waving.
But skepticism cannot become an alibi. Suppose the attribution is wrong and some ransomware crew or bored teenager did this. The lesson is identical, and worse. Food and blood storage were exposed to anyone with patience and a browser. Whether the culprit wears a uniform hardly matters to a store manager watching alarms fail to ring.
Europe is not without tools. Its NIS2 directive pulls food distribution into the category of critical sectors, and the Cyber Resilience Act is meant to force manufacturers to ship connected products that aren't hopelessly insecure. The question is whether anyone will enforce them against profitable companies, or whether this becomes another regulatory gesture that ages quietly in a drawer. Voluntary standards got us here. Companies treat resilience as a cost to minimize until the day it becomes someone else's emergency.
The Left should be saying something plain. If you sell equipment that controls the temperature of food and medicine, you are selling a piece of public safety, and you should be liable for shipping it with default passwords and exposed dashboards. If you run 700 stores on that equipment, regulators should audit your security as seriously as your hygiene. We inspect kitchens for rodents. We should inspect control systems for open doors.
The answer to a foreign state allegedly hacking supermarkets is not louder rhetoric about hostile regimes. It is a boring, unglamorous insistence that essential systems be built to withstand attack, and that the firms profiting from them pay for it. Governments love to talk about national security. Here is a chance to practice it, by making private companies stop treating the public's food and blood supply as an externality.
How it may affect me
If a store reports a refrigeration outage, avoid buying thawed or partly thawed frozen items, and discard anything that has been above safe temperatures for long. At home or work, change default passwords on any internet-connected fridge, freezer or monitoring system and disable remote access you don't use.
