Europe’s infrastructure and public services are facing a growing series of cyberattacks, bomb threats and suspected sabotage operations attributed to state-linked and non-state actors, exposing the expanding reach of hybrid warfare. French authorities have directly accused Iran of orchestrating a large-scale cyberattack against refrigeration systems that affected more than 700 supermarkets and grocery stores, caused food spoilage and triggered approximately 20 fires. The incident has intensified concerns that hostile actors are increasingly targeting the systems and services on which civilian populations depend.
According to an assessment by the Soufan Center, the attacks illustrate how cyber operations and other forms of disruption can impose costs extending well beyond financial losses or temporary inconvenience. Their psychological impact can be particularly significant in Western societies, where interference with essential services can affect public confidence in governments responsible for protecting citizens and maintaining critical infrastructure. The assessment places the French incident alongside a wider series of suspected hybrid operations across Europe, including bomb threats against aircraft, schools and media organisations.
Laure Beccuau, Paris’ chief prosecutor, said the refrigeration attacks were carried out by members of Iran’s Electronic and Cyber Center, an organisation associated with the Islamic Revolutionary Guard Corps (IRGC). French authorities directly accused Tehran of responsibility for the operation, which affected hundreds of refrigeration systems across the country. The resulting disruption led to substantial food spoilage and approximately 20 fires, with more than 700 supermarkets and grocery stores affected.
Jean-Noël Barrot, France’s Foreign Minister, described the incident as an unprecedented act of sabotage on French territory. Speaking at a G7 meeting in Paris earlier this week, he said: “This is the first large-scale cyberattack carried out for the purpose of sabotage on national territory, and it constitutes a major threat to the nation’s interests and the security of the French people.”
The attack comes as European governments are increasingly advising citizens to prepare for national emergencies, including those arising from disruptions to essential services. In the United Kingdom, residents have been encouraged to maintain supplies of food, water and medicine in preparation for emergencies. The range of potentially vulnerable systems extends well beyond commercial businesses. Transportation networks, communications, hospitals, emergency services, schools, financial institutions and facilities providing water, electricity and energy could all become targets of cyber operations.
The capacity of state and non-state actors to cause disruption through digital operations has also expanded as the barriers to conducting cyberattacks continue to decline. North Korea was recently accused of hacking cryptocurrency exchange Binance, with criminals reportedly stealing more than $6 billion. According to the assessment, Pyongyang uses proceeds from cybercrime to finance its missile programmes, while some of the money could also reach Iranian networks given the longstanding cooperation between North Korea and Iran in ballistic missile development and other military technologies.
Europe has experienced a succession of incidents that security analysts associate with possible grey-zone warfare or hybrid tactics. Over several weeks, bomb threats targeting commercial aviation disrupted flights across the continent. According to the BBC, flights to and from Lisbon, Rome, Prague and Sofia were targeted, resulting in cancellations and significant disruption for airlines operating across Europe and beyond.
The threats subsequently extended to broadcasting organisations and educational institutions. Irish broadcaster RTÉ, the Dublin offices of NewsTalkFM and TodayFM, and British broadcaster Sky received threats. Thousands of schools across Italy, Ireland and the United Kingdom were also targeted by hoax bomb threats. The incidents appear to form part of a coordinated campaign intended to disrupt ordinary activities across several European countries, although the source does not establish responsibility for the threats.
Other developments have added to European security concerns. Earlier this week, the United States announced that it would relocate some of its aircraft from RAF Fairford in the United Kingdom. Separately, information emerged that Mohammad Baqer Saad Dawood al-Saadi, a commander of Kataib Hezbollah, had allegedly coordinated terrorist plots from his prison cell in New York. He reportedly used coded language to communicate instructions to family members, who then passed the information to individuals involved in a suspected plot in the United Kingdom.
Al-Saadi is believed to be the mastermind behind Harakat Ashab al-Yamin al-Islamiya (HAYI), an Iranian-backed front organisation that claimed responsibility for nearly 20 terrorist plots in Europe during the spring. The organisation reportedly relied on so-called “disposable agents” to carry out attacks against Jewish targets, including synagogues. The alleged communications operation illustrates how individuals detained outside a conflict zone can potentially remain connected to networks operating across international borders.
The Soufan Center’s assessment places these incidents within the broader practice of hybrid warfare, which is designed to operate between the conventional boundaries of peace and armed conflict. Such operations can combine cyberattacks, sabotage, disinformation, covert action and other forms of pressure without necessarily triggering a conventional military response. Russia has employed what are sometimes described as “salami-slicing” tactics, involving incremental actions that individually may appear limited but can collectively produce significant strategic effects.
Moscow regards hybrid operations as an effective means of applying pressure on Western countries, including the United States and the United Kingdom. China, Russia, Iran and North Korea have also been described as increasingly willing to employ such methods when they perceive Western responses as insufficient. Russia and Iran, both involved in conflicts without clear end points, are devoting additional resources to developing these capabilities, while other states may follow the same approach.
A central objective of hybrid warfare campaigns is to weaken public willingness to support governments’ foreign policy and military commitments. The reasoning is that populations experiencing prolonged electricity outages, restricted access to banking services, disrupted transport or threats to their children’s safety may become less willing to support military involvement in conflicts beyond their own borders. The disruption of ordinary civilian life can therefore become a means of exerting pressure on political decision-making without directly confronting a country’s armed forces.
The assessment notes that these operations rarely occur in isolation. Cyberattacks, sabotage and other forms of disruption can accompany conventional military activities, espionage and covert operations, allowing states to apply pressure across several fronts while remaining below the threshold of open warfare.
