France named Iran for the supermarket fridge sabotage. Its allies, and one think tank, drew narrower lines

On the night of 11–12 October attackers took remote control of commercial refrigeration controllers in France and forced defrost settings to high temperatures — “as high as 50 degrees Celsius,” according to the video description accompanying CNBC’s 10 November report. The scale is reported inconsistently and should not be averaged: AP, carried by SecurityWeek and ABC News, says about 700 of France’s 10,000 supermarkets; The National says about 700 commercial sites and at least 15 fires; the insurance outlet Beinsure said on 14 November that roughly 750 supermarkets were hit; Reuters says “hundreds.” Al Jazeera named E-Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U among the chains affected; AP reported Intermarché losses of tens of millions of euros in a single day. On 9 November the French Foreign Ministry attributed the operation to Shahid Kaveh, an offensive unit it places under the IRGC’s Cyber Electronic Command. Foreign Minister Jean-Noël Barrot called it “the first large-scale cyberattack carried out for sabotage purposes on French soil.”

Paris prosecutor Laure Beccuau opened an investigation into suspected organised cybercrime with the aggravating circumstance of “having been committed to serve the interests of a foreign power,” and prosecutors are seeking international arrest warrants for three men named on 10 November and reported by The National: Hamid Reza Lashgarian, 65, described as the unit’s leader and carrying a US $10 million bounty, Reza Salarvand and Mahdi Lashgarian. Iran has not acknowledged responsibility and denies conducting cyberattacks abroad. The published evidentiary basis is thin by the standards of state attribution: investigators cited Farsi-language artefacts and IP addresses resolving to devices in Iran, both of the weakest commonly published kind. The CERT-FR technical publication and the Foreign Ministry’s formal attribution declaration are the primary documents; neither has been independently assessed by a third party in the reporting reviewed here.

Three qualifications surfaced inside the 12–15 November window. The Disinformation Observer, an independent newsletter, reports that the G7 statement of 11 November, following the Paris meeting, condemned sabotage of critical infrastructure without naming a state — three days after France named Iran. That claim is single-sourced to a newsletter and the communiqué is a primary document worth pulling. The same newsletter reports that ANSSI director Vincent Strubel said there was no evidence yet that a separate attack on a blood service involved the same actor. And on 13 November the Foundation for Defense of Democracies, a Washington think tank the Wall Street Journal describes as “long critical of Iran,” accepted the IRGC attribution while contesting the unit, arguing the Cyber Isnaad Front sits closer to Shahid Shushtari and noting that the US Treasury sanctioned Mohammad Bagher Shirinkar as head of Shahid Shushtari where France calls him a Shahid Kaveh commander.

Assessment: The interesting resistance to this attribution is not coming from Tehran, which simply denies, but from within the Western apparatus: a G7 text that condemns the act without the actor, a national agency head declining to annex a convenient second incident, and a hawkish think tank quarrelling over org charts. Each has a different incentive. The G7 protects members with exposure to Iranian retaliation; Strubel protects ANSSI’s evidentiary standard; FDD is defending its own mapping of IRGC units. Also hold the October event and the 2 November second wave apart — Al Jazeera lists five affected countries, Beinsure nine, and investigators have not established who directed the November round.