France’s attribution of a large-scale cyberattack against supermarket refrigeration systems to Iranian state-linked operatives has highlighted an important vulnerability in corporate crisis management: digital incidents can rapidly become physical emergencies, commercial losses and reputational problems.
The attack, which occurred overnight on 11–12 October, affected refrigeration controllers at approximately 700 retail locations across France.
According to the French national cybersecurity agency, ANSSI, attackers remotely modified equipment settings, causing temperatures to rise and compromising food stored in affected facilities.
The incidents resulted in substantial financial losses and at least 15 cases in which fires began.
On 9 November, French authorities formally attributed the operation to cyber units associated with Iran’s Islamic Revolutionary Guard Corps. Iran has rejected the allegations.
Although the investigation concerns state-sponsored activity, its implications extend to businesses of many sizes.
The central lesson is that cybersecurity cannot be treated exclusively as a technical responsibility when an incident affects customers, employees, suppliers and public confidence.
An Operational Failure Becomes a Communications Crisis
Cybersecurity incidents are often associated with stolen personal information, ransomware or interruptions to online services.
The French attack followed a different pattern.
Rather than concentrating on customer databases, attackers manipulated operational technology controlling physical equipment.
The consequences were immediately visible.
Refrigerated products became unusable, food safety concerns emerged and businesses faced substantial disruption.
Such incidents create communication requirements that differ from conventional data breaches.
Customers need to know whether products are safe, whether stores remain operational and whether purchased goods should be returned.
Employees require reliable instructions about handling inventory and dealing with enquiries.
Suppliers and insurers need information concerning equipment failures, product losses and business interruption.
Local authorities may also require updates where food safety or public safety is affected.
A communications strategy focused solely on the technical cause of the cyberattack would therefore overlook many of the most pressing concerns.
The First Public Statement Must Establish What Is Known
One of the most difficult decisions during an operational emergency concerns when a company should communicate publicly.
Waiting for a complete technical investigation can leave customers and employees without essential information.
However, issuing premature explanations can create further difficulties if subsequent findings contradict initial statements.
An effective response distinguishes confirmed facts from matters still under investigation.
A company might be able to confirm that particular equipment malfunctioned and that affected products have been removed from sale without knowing how the failure occurred.
Those operational facts can be communicated while the investigation continues.
Statements should also identify practical actions taken to protect customers and restore services.
Excessively technical language can obscure the information most relevant to the public.
The objective is not to disclose every element of the cybersecurity investigation, particularly where doing so could compromise security.
It is to provide accurate information that allows affected parties to make informed decisions.
Coordinating Several Organisations
Modern commercial infrastructure frequently depends on external providers.
Refrigeration controllers may be manufactured by one company, installed by another and maintained remotely by a third.
Retailers may also depend on separate suppliers for network infrastructure, monitoring software and technical support.
When an incident occurs, these relationships can create uncertainty over who is authorised to issue statements.
Different organisations may possess different information about the cause and scope of the disruption.
An equipment supplier may concentrate on technical vulnerabilities, while the retailer must respond to questions about food safety and consumer protection.
Inconsistent public explanations can undermine confidence even when individual statements are factually accurate.
Businesses therefore benefit from establishing crisis coordination arrangements before an emergency.
These should identify spokespersons, internal reporting procedures and methods for exchanging verified information with contractors.
The arrangements must also account for confidentiality, regulatory reporting obligations and the preservation of evidence.
Cyber Attribution Requires Particular Caution
The French government’s attribution to Iran illustrates another communications challenge: identifying responsibility for a cyberattack.
Corporate victims may experience substantial disruption long before investigators can establish who carried out the operation.
Speculation about perpetrators can generate legal, diplomatic and reputational consequences.
Companies should distinguish their operational assessment from conclusions issued by competent investigative authorities.
A statement confirming a cybersecurity incident does not require the organisation to identify a hostile government or criminal group.
Similarly, businesses should avoid describing an incident as a personal-data breach unless there is evidence that personal information was compromised.
Different types of cyber incidents create different legal obligations.
Crisis Communications Should Be Tested Like Technical Systems
Businesses routinely test IT infrastructure, security controls and operational continuity arrangements.
Corporate communications procedures require comparable preparation.
A practical exercise could simulate equipment failures, customer complaints, media enquiries and contradictory information from suppliers.
The purpose would be to establish whether technical teams, management and communications personnel can make decisions using a common set of verified facts.
Prepared communication templates can help, provided they allow sufficient flexibility to reflect the actual incident.
Monitoring procedures should also identify inaccurate claims circulating online without amplifying unverified rumours.
The Commercial Cost of Uncertainty
The French attacks demonstrate that damage from a cyber incident can extend far beyond repairing the compromised equipment.
Lost inventory, interrupted operations, customer concerns and disputes between suppliers may continue after technical systems have been restored.
Public confidence depends partly on how clearly companies explain the disruption and their response.
For businesses operating interconnected physical infrastructure, cybersecurity planning should therefore include operational crisis communication from the beginning.
The relevant question is not only whether an organisation can recover its systems.
It is whether it can communicate accurately and consistently while those systems are unavailable, their reliability remains uncertain and customers require immediate answers.
