We covered the attack itself in October and the second wave across Europe. What's new is who France says did it. The attribution comes from France's Cyber Crisis Coordination Center (C4), which brings together the national cyber agency ANSSI, military cyber command and intelligence services.
What France is doing about it. France summoned Iran's ambassador and will ask its EU partners for new sanctions on the Iranian people and organizations involved. Paris prosecutor Laure Beccuau has opened an investigation into Shahid Kaveh's leaders and asked for arrest warrants against two of its officials, according to DW. French intelligence says the unit mainly targets Israel and the US, with industrial equipment as its usual target.
How the sabotage worked. Per the prosecutor, the attackers went in through the controllers' web interfaces, started abnormal defrost cycles that never ended, and turned off the alerts that fire when cases get too warm. BleepingComputer says at least 15 fires followed. CERT-FR's technical report lists Casino, E.Leclerc, Coopérative U, Metro, Carrefour and Intermarché, along with small butcher shops, a slaughterhouse and food-processing co-ops. Axios reports the same operation also went after equipment at small hydroelectric sites, with limited effect.
What isn't attributed. France has tied only the October attacks on French stores to Iran. The later wave that spread to other European countries hasn't been publicly attributed to anyone.
Why buyers should care. Until now this looked like opportunists poking at old, internet-facing controllers. A state unit doing it on purpose changes the risk math for every retailer, cold-chain operator and food distributor. Ask your facilities team and refrigeration contractor which controllers can be reached from the internet, take them off it, put contractor access behind a VPN, and make sure temperature and defrost alarms go to a person, not just a dashboard nobody watches at night.