France has accused Iran's Islamic Revolutionary Guard Corps of the cyber-attacks that raised the temperatures of supermarket fridges and freezers across the country last month.
This site covered the attack itself on 24 October and returned to it on 3 November, when the striking thing was that nobody had claimed responsibility and no government had named anyone. That has now changed.
What the French government is saying
Foreign Minister Jean-Noël Barrot called the attack "unprecedented in both its scale and its level of aggression", and said those responsible would face sanctions.
He went further on what it represents: it "marks the first large-scale cyber-attack aimed at sabotage on our national territory, and it constitutes a major attack on the nation's interests and the security of the French people".
The government summoned the Iranian ambassador to Paris to "lodge a very strong protest against this extremely grave act". France will take "any other necessary and proportionate measures" to respond and "deter anyone who might seek to repeat it", Barrot added.
A named unit, and a criminal case
This is not a vague accusation, which is what makes it unusual. The Paris prosecutor, Laure Beccuau, has opened an investigation into the head of an offensive cyber unit associated with the IRGC, along with his two deputies.
She named the unit as Shahid Kaveh, which she said is affiliated with the electronic and cyber centre of the Revolutionary Guard. Shahid Kaveh is the name given to a cluster of hackers believed to be directly employed by the Iranian state.
Iran has not responded officially. Some Iranian media outlets have dismissed the allegations as baseless.
What actually happened, again
On 11 October, hackers gained control of the software that regulates the temperatures of refrigeration units used in many French supermarkets. Tons of chilled and frozen food were destroyed. A similar wave then hit supermarkets in several other European countries; it is not known whether the two are linked.
That last point matters for how much this attribution settles. France has named a suspect for the attacks on French soil. The wider European wave remains unattributed.
The uncomfortable context
In recent weeks, commentators and politicians in Iran have argued that the country should extend any retaliation beyond the Middle East if the United States and Israel resume the war they began earlier this year. Whether these attacks were part of that deterrence posture is not known.
The reason to report that carefully rather than confidently is that the alternative reading is just as plausible: a capability was demonstrated on soft targets precisely because it is deniable.
For Bangladesh the lesson is the one this site has now made three times, and it has only got sharper. The equipment that failed was industrial refrigeration control — unglamorous machinery reachable from the internet, running in supermarkets rather than in anything anyone would call critical infrastructure. Cold chains here depend on the same category of kit.
What sanctions on a cyber unit actually do
Barrot's promise of sanctions is worth reading soberly. Sanctions on named members of a state cyber unit rarely stop that unit operating, because its people are not holding assets in Paris and were never going to travel to Europe.
What they do is create an official record of attribution that other governments can adopt without repeating the investigation, and they raise the cost of the next operation by making deniability harder. That is a slower instrument than it sounds in a press conference, and it is still the main one available.
