It was about 1.15am when the SNCF maintenance workers, carrying out repairs by moonlight, spotted the group of people a little further down the railway line near a signal box outside the sleepy village of Vergigny, in the northern French department of Yonne.

They were concerned enough by the unlikely sight at such an hour to approach the intruders, and then to make a call to the local police as those they had interrupted ran off into the dark.

That sighting, along with the remains of incendiary devices left behind at what are now crime scenes across the French rail network, will form a crucial part of the investigation into what was on Friday being described by one Socialist senator as the “destabilisation, sabotage and the calling into question of the image of France” in the hours before the opening ceremony of the Olympic Games in Paris.

The methods used by the arsonists appeared crude – starting fires to destroy the fibre optic cables at signal boxes along France’s high-speed rail lines – but the damage has been no less severe for it, both to the transport infrastructure and the country’s confidence in its security preparations before the next fortnight of sport.

“It’s a huge security job, it’s meticulous, it’s wire by wire that we have to repair all these cables that have been damaged and burned,” said Jean-Pierre Farandou, chief executive of the SNCF.

For all the claims from senior French politicians, including Paris’s mayor, Anne Hidalgo, that the attack had been irrelevant to Friday night’s soggy ceremony on the Seine, the British prime minister, Keir Starmer, had been among those forced to change his travel plans.

A Downing Street spokesperson confirmed that he had intended to take the Eurostar but had to fly. France’s SNCF railway operator said it would be urgently tightening security around the rail infrastructure “in coordination with the forces of law and order”.

It was an undeniably shaky start to what had been billed as the largest peacetime security operation on French territory, in which 45,000 police and gendarmes had been deployed on the streets. The hunt is on to get quick justice. But who was behind it?

Beyond charred cables and the fleeting sight of some of the arsonists, a further line of inquiry did emerge on Friday.

An incendiary device had also been discovered on the Aix-Marseille TGV line on 8 May, it was revealed, when the Olympic flame was arriving in the region.

Thursday night’s attacks had been intended to disable the TGV’s nerve centres outside Paris: the signal boxes at Courtalain (Atlantic high-speed line), Croisilles (LGV Nord) and Pagny-sur-Moselle (LGV Est).

Had the device found in Aix-Marseille been a trial run? Or an earlier failed attempt to disrupt France’s Olympic preparations?

Seeking to piece together the jigsaw is Paris public prosecutor Laure Beccuau, who announced that she would be taking charge of the investigation into “all the wilful damage caused to SNCF sites”.

Gérald Darmanin, France’s interior minister, said the security forces were “hoping to swiftly make arrests”.

But there were words of caution from the prime minister, Gabriel Attal, over speculation about the identity of the perpetrators at a time, he suggested, when rumour and fear might prove as destabilising as the crimes themselves.

“The investigation is starting, I call on everyone to be cautious,” Attal said. “What we know, what we see, is that this operation was prepared, coordinated, that nerve centres were targeted, which shows a form of knowledge of the network to know where to strike,” he said.

Attal added he could not “say more about the perpetrators, the motivations”.

Israel’s foreign minister, Israel Katz, did not heed Attal’s call, instead claiming on social media that it had been the work of Iranian proxies, although he offered no evidence.

“The sabotage of railway infrastructure across France ahead of the Paris 2024 Olympics was planned and executed under the influence of Iran’s axis of evil and radical Islam,” he wrote on X.

“As I warned my French counterpart this week, based on information held by Israel, Iranians are planning terrorist attacks against the Israeli delegation and all Olympic participants.

“Increased preventive measures must be taken to thwart their plot. The free world must stop Iran now – before it’s too late.”

Another theory is that it was a Moscow-inspired attempt at destabilisation.

On Sunday, French police had arrested Kirill Griaznov, 40, a cordon bleu chef and reality TV star who they suspect of being a member of the FSB, the Russian security agency. He is being detained on charges of plotting a “large scale” operation to destabilise France.

Security services across Europe have long been on alert to Russian sabotage after alleged Russian involvement in an arson attack in east London, an inferno that destroyed the largest shopping mall in Poland, a sabotage attempt in Bavaria in Germany and antisemitic graffiti in Paris.

France’s former ambassador to Moscow, Jean de Gliniasty, was among those on Friday to say he believed Moscow’s involvement was possible.

“We are obviously in a situation of conflict with Russia, and Russia is obviously not going to do anything, and that is an understatement, to help these Olympic Games be a success,” he said.

A further theory is that the crimes bore the hallmarks of the extreme anarchist left. Eight people were prosecuted in 2018 of being part of an anarchist group that attempted to sabotage part of France’s high-speed rail network a decade earlier. They were, however, cleared of the crime.

As a “no flight” restriction above the French capital was lifted, and the sharpshooters put away their weapons, Parisiens were grateful to have their city back after a ceremony that had forced many of them into conditions not unlike lockdown. But the last 24 hours had shown just how vulnerable they remain.