The French attribution covers October. The European wave it is being used to explain is still unclaimed

Barrot’s attribution covers the French incidents of 11–12 October. It does not cover the separate wave of 2 November, when grocery stores in at least nine other European countries were hit by a suspected cyberattack on freezer systems, reported by France 24 and AFP and still unattributed. Cybernews reports that in the week before the French announcement, the Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility for attacks on refrigeration systems across Europe. Two mutually exclusive accounts are now sitting over an overlapping set of incidents, and most aggregation is treating “France blamed Iran” as having settled the European question. It has not. The numbers are drifting too: Al Jazeera’s page carries both “more than 1,000 stores” and “about 700 stores” in its own furniture. Barrot’s on-the-record figure, as carried by AFP, France 24, NPR and CNBC, is 700 French sites.

The same compression is pulling in events that were never established as attacks at all. CBC notes that refrigerators at at least half a dozen US military commissaries went out of commission in August; NPR adds that the Pentagon has made no official statement on those disruptions and has not concluded they resulted from a cyberattack. Three months on, that remains the position. Two further claims are circulating without primary sourcing and are not carried here: an aggregated account of fifteen fires and tens of millions of euros in losses, and a reported finding by France’s cyber crisis coordination body C4 that the same infrastructure probed Schneider Electric equipment at energy and water facilities. Cybernews, citing Reuters and three people familiar with the matter, says Microsoft privately linked Iran to the October attacks at least two weeks before Paris spoke — anonymous, and secondhand through an aggregator.

Assessment: The C4 line is the one to chase. If a public French document shows the October infrastructure probing industrial control gear at energy and water sites, this stops being a food-spoilage story and becomes a pre-positioning story, with a different threshold for response. Until that document surfaces, the aggregation is doing the analytical work by accretion: an October attack, a November wave, an August commissary failure and a six-month-old CISA advisory stacked into a single Iranian campaign that nobody has demonstrated. The hacktivist claims cut the other way and deserve the same scepticism — claiming credit is free. The honest position today is that one set of incidents has a state attribution and the rest have none.