France Blames Iran’s Revolutionary Guards for the Supermarket Freezer Attacks, Counting About 700 Sites and at Least 15 Fire Outbreaks, but Neither of Its Two Documents Names a Controller, a Flaw or the Way In

France said on Monday, November 9, that Iran’s Revolutionary Guards were behind the attack of the night of October 11 to 12 that altered the refrigeration controllers of about 700 large-retail sites, caused food losses the ministry puts at several tens of millions of euros, and started fires in at least 15 cases. A foreign ministry statement names the Guards’ cyber-offensive unit Shahid Kaveh as the executor, and a report from France’s Cyber Crisis Coordination Center (C4), published by CERT-FR, gives four indicators behind that call. BleepingComputer’s account matches the French texts on the facts we checked; it leaves out the report’s hedge and its second Guards unit. We read both French documents in the original and set them against our October 13 report, the October alerts and the vendor and CISA records.

The attribution names who France says ordered and ran the attack, 28 days after it. It does not answer the question defenders have asked since October 13, which is how the controllers were reached. Neither document names a vendor, a CVE or an entry route (a count of both texts is at the end), the C4 report calls its own case a “faisceau d’indices” (a bundle of indicators), and the ministry attributes only the first night. It does not attribute the November attacks on more than 115 stores in six other countries or the incident at three blood-storage facilities. Everything below is as of Monday evening, November 9 (UTC), and we did not probe any device.

What the two French documents say, and where they differ

The ministry statement is the political document and the C4 report is the technical one. Both are in French. The French in quotation marks is verbatim; the English glosses are ours. The facts broadly agree, but the firmness does not.

The two texts are consistent, but only the report shows the hedge, so anyone quoting the ministry alone loses it. The report also reaches back. It attributes a 2020 plan against Charlie Hebdo, the defacement of the weekly’s online shop and exfiltration of its database on January 4, 2023, and a July 2024 compromise of a company running video display terminals before the Paris Olympics to a different Guards unit, Shahid Shoostari, which it says is also known as Emennet Pasargad. The ministry adds that the EU adopted sanctions in March 2026 against that entity (it spells the name “Emmenet Pasargad”).

The four indicators the report gives, and what each can show

The C4 report ties the October attack to Shahid Kaveh with four observations. We list them in the report’s words. The middle and right columns are our reading; the report gives none.

For the October attack the report prints no IP address, domain or file hash, and names one tool, the FOFA scan platform. The count at the end of this article finds no address or hash in either document, and the report’s one defanged domain belongs to the 2024 Olympics case. That case is more specific: the report dates the compromise from July 20, 2024, says the first photomontages appeared on July 24, and says the attackers used “deux adresses IP appartenant à des FAI iraniens” (two IP addresses belonging to Iranian internet providers), though it does not print them. This is a public summary of the C4’s work, and it does not say what other evidence the members hold.

How the numbers moved since October 13

Scale. The figures in October came from retailers. The statements in our October 13 report added up to about 490 stores (300 Intermarché and Netto, about 80 Coopérative U, 80 Carrefour and about 30 Monoprix), with E.Leclerc giving no number and Casino and Metro not yet named. The C4 report’s “environ 700 sites” is 210 more than that tally. It counts large-retail sites, lists the further victims without a count, and does not say how many controllers each site had, so the 700 cannot be turned into a number of devices. The ministry says “plus de 700” (more than 700) and the report says “environ 700” (about 700); BleepingComputer writes “more than 700 supermarkets and other retail locations”.

Fires. The French term, départ de feu, means a fire starting. The documents do not say how large any of them grew, at which sites, or what burned. Our October 13 report relayed that the Paris prosecutor’s office described the damage as lost food and outbreaks of fire, and that franceinfo, relaying AFP, took that to mean equipment that began to catch fire; the C4 report is the first official document we have seen that puts a number on it. The mechanism reported in October was a forced continuous defrost with a set point of 50 degrees (BFMTV’s sources, as relayed in that report), and CISA’s fact sheet lists “Create a fire hazard” among the effects of a changed temperature. No source we read explains how a defrost change starts a fire, so we do not.

Where the technical record lives, and why it does not settle the question

The names of the product families come from a different French document, the CERT-FR alert CERTFR-2026-ALE-012 (first version October 12, last version October 16). Its list of affected systems is “Copeland xweb”, “Danfoss série AK-SC”, “Danfoss série AK-SM” and “Dixell xweb”, and its revision table says that on October 13 it added “d’autres équipements ciblés” (other targeted equipment). Our October 13 report, published that morning, named only Danfoss. Both product families have a public flaw record that could fit the October attack. None of the documents says it was used, and a fit is not a finding.

The exploited-vulnerabilities list does not settle it either. CISA’s KEV catalog (version 2026.11.09, 1,772 entries) has no entry for a Danfoss, Copeland, Dixell or XWEB product. CISA’s November 5 fact sheet names three vectors, “Authentication bypass; Arbitrary code injection; and Weak configurations”, for activity it describes as targeting systems “globally”, and names no vendor or CVE. BleepingComputer writes that the October attacks “targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers” and, of the two 2025 Danfoss CVEs it lists, that “it has not been confirmed whether these vulnerabilities are being exploited in the attacks”.

One attribution, several incidents

The statement describes the night of October 11 to 12 only. BleepingComputer says so directly: “France has attributed only the October attacks against French supermarkets to Iranian hackers, not the later attacks.” What links the later incidents to October is, so far, a trade claim and similar symptoms. The director of the Belgian installer Sabcobel told RTL that the attackers used “le même mode opératoire” as in France and spoke of protecting customers’ units against “cette vulnérabilité”; BleepingComputer renders that as the same vulnerability. Coolworld, the supplier in the blood-service incident, says in its statement that “The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld’s direct control.” EFS says, in BleepingComputer’s translation of its statement (the page blocks scripted fetches), that “No health impact has been identified, and no loss of blood products has been reported”. Nothing we read ties the November incidents to Shahid Kaveh, and none of the sources we read includes a response from Iran.

What operators can do now, from the sources

These steps come from CERT-FR, Copeland and CISA, and none of them depends on knowing which flaw was used.

• Take the controllers off the public internet. ALE-012 says to remove internet exposure for the affected units “et de toutes les unités exposées sur une adresse IP publique” (and every unit exposed on a public IP address) and to restore access “uniquement via un VPN sécurisé ou un réseau protégé” (only through a secure VPN or a protected network). Copeland’s list for XWEB EVO is stricter: “Aucune redirection de port, aucune DMZ et aucune adresse IP publique directe.” CISA’s first mitigation is “Eliminate public internet exposure”. Copeland also gives a test: from a connection outside the site, such as a phone with Wi-Fi off, enter the site’s public IP address in a browser, and the XWEB login page “ne doit pas s’afficher”.
• Read the contract before cutting the feed. ALE-012 says to “Vérifier les conditions contractuelles d’assurance avant de couper la remontée des données Internet vers le prestataire frigoriste” (check the insurance contract conditions before cutting the internet data feed to the refrigeration contractor). The alert does not explain why; we read it as a warning that cutting the remote feed can affect cover. As an urgent stopgap it allows filtering source IP addresses to the contractor’s, “mais cette solution ne doit pas être considérée comme pérenne”.
• Check the configuration, not only the access. ALE-012 asks for the whole configuration to be checked, “notamment les plages de dégivrage” (notably the defrost windows). For Danfoss units it says to update the firmware, set the security level to Strict and make sure default passwords have been changed. Copeland adds two checks: look at product temperatures directly in the cabinets, and trigger a test alarm to confirm the notifications arrive.
• Treat unpatched end-of-life units as exposed even after a reset. ALE-012 says that keeping an unpatched end-of-life unit on the internet exposes it to “une très forte probabilité de compromission”, that a factory reset alone is “insuffisant” in that case, and that the device “restera vulnérable et sera certainement de nouveau compromis”. As of its October 16 revision it says attack campaigns “sont probablement toujours en cours”. CISA asks owners to “identify, retire, and replace legacy devices”.
• Isolate and restrict. CISA’s list adds a dedicated OT VLAN, changed and strengthened passwords, an allowlist of devices and IP addresses allowed to make changes, and offline backups.
• Our addition, not from these sources: put at least one temperature probe with its own alarm path on a critical cabinet, independent of the controller. The attack works by changing the controller that normally raises the alarm, and CISA lists “Loss of visibility into current temperatures (a denial-of-view condition)” among the effects. EFS says its monitoring and alarm systems detected the change quickly (BleepingComputer’s summary), which is the pattern the probe is meant to copy.
• Ask your contractor, in writing, which controller model and firmware each site runs, who has remote access and who is responsible for updates.

What is still unknown

• The way in. The attackers used the FOFA scan tool, according to the report. Whether they then used a flaw, default or stolen credentials, or a contractor’s remote-access path is not said. CISA lists three vectors for activity it describes as global.
• Which products. ALE-012 lists Danfoss AK-SM and AK-SC and Copeland and Dixell xweb. The C4 report names none of them. Danfoss described the affected units in October, while Copeland’s bulletin speaks of a vulnerability on XWEB EVO without saying whether any French store was reached through it.
• How many controllers. The report counts sites. It does not say how many controllers were compromised, or how many remain compromised or exposed.
• The fires. At least 15, with no sites, size or cause given.
• The later attacks. Not attributed. Whether the November incidents and the blood-service incident share an actor, a flaw or only a product family is open.
• What follows. France says it will summon Iran’s ambassador and propose new European sanctions, and reserves other measures, public and non-public. The ministry cites EU sanctions of March 2026 on Emennet Pasargad as background.

What the two documents contain, counted

To check the claim that neither French document names a vendor, a CVE or a weakness, we counted terms in both texts with a short standard-library script. Save the ministry page and the report, extract the report’s text, and run the script (any Python 3):

curl -L -o mfa.html "https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/declaration-d-attribution-a-l-iran-de-cyberattaques-visant-la-france"
curl -L -o certfr.pdf "https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-009.pdf"
pdftotext -layout -enc UTF-8 certfr.pdf certfr.txt
python docscan.py mfa.html certfr.txt

"""docscan.py MFA_FILE CERTFR_FILE

Counts what the two documents France published on 9 November 2026 do and do not contain.
MFA_FILE: the foreign ministry statement, saved as text or as the page's HTML.
CERTFR_FILE: the C4 report CERTFR-2026-CTI-009, saved as text (pdftotext -enc UTF-8).
Also prints the day gaps and the retailer arithmetic used in the article. Standard library only.
"""
import html
import re
import sys
from datetime import date


def load(path):
    raw = open(path, encoding="utf-8", errors="replace").read()
    if raw.lstrip().startswith("<"):
        raw = re.sub(r"(?is)<(script|style|noscript|svg).*?</\1>", " ", raw)
        raw = re.sub(r"(?is)<br\s*/?>|</p>|</h\d>|</li>|</div>", "\n", raw)
        raw = html.unescape(re.sub(r"(?s)<[^>]+>", " ", raw))
    return raw


def statement_body(text):
    start = text.find("Le : 09 novembre 2026")
    end = text.find("Lien vers le communiqu")
    if start >= 0 and end > start:
        return text[start:end]
    return text


def norm(text):
    return re.sub(r"\s+", " ", text.replace(chr(0xA0), " ").replace(chr(0x2019), "'")).lower()


mfa = norm(statement_body(load(sys.argv[1])))
cert = norm(load(sys.argv[2]))

TERMS = [
    ("Danfoss", r"danfoss"),
    ("Copeland, Dixell or XWEB", r"copeland|dixell|xweb"),
    ("a CVE identifier", r"cve-\d{4}-\d{4,}"),
    ("vulnerabilite or faille", r"vuln.rabilit|faille"),
    ("mot de passe", r"mots? de passe"),
    ("prestataire or frigoriste", r"prestataire|frigoriste"),
    ("Schneider Electric", r"schneider"),
    ("FOFA", r"fofa"),
    ("Modbus", r"modbus"),
    ("faisceau d'indices", r"faisceau d'indices"),
    ("en mesure d'attribuer or d'imputer", r"en mesure d'(?:attribuer|imputer)"),
]

print(f"{'term':38} {'ministry':>9} {'C4 report':>10}")
for label, pattern in TERMS:
    print(f"{label:38} {len(re.findall(pattern, mfa)):>9} {len(re.findall(pattern, cert)):>10}")

IOC = [
    ("IPv4 address", r"\b(?:\d{1,3}\.){3}\d{1,3}\b"),
    ("64-character hash", r"\b[0-9a-f]{64}\b"),
    ("defanged domain, name[.]tld", r"\w\[\.\]\w"),
]
print()
for label, pattern in IOC:
    print(f"{label:38} {len(re.findall(pattern, mfa)):>9} {len(re.findall(pattern, cert)):>10}")

print()
attack = date(2026, 10, 12)
for label, day in [
    ("CERT-FR alert ALE-012", date(2026, 10, 12)),
    ("Copeland XWEB bulletin", date(2026, 10, 14)),
    ("second wave and blood-service incident", date(2026, 11, 2)),
    ("CISA and FBI fact sheet", date(2026, 11, 5)),
    ("French attribution", date(2026, 11, 9)),
]:
    print(f"{label:40} {day.isoformat()}  day {(day - attack).days:>2} after 12 Oct")

print()
stores = {"Intermarche and Netto": 300, "Cooperative U": 80, "Carrefour": 80, "Monoprix": 30}
print("retailer counts in our 13 Oct report:", sum(stores.values()), "stores", stores)
print("gap to the 'about 700 sites':", 700 - sum(stores.values()))

The output on November 9:

term                                    ministry  C4 report
Danfoss                                        0          0
Copeland, Dixell or XWEB                       0          0
a CVE identifier                               0          0
vulnerabilite or faille                        0          0
mot de passe                                   0          0
prestataire or frigoriste                      0          0
Schneider Electric                             0          4
FOFA                                           0          1
Modbus                                         0          2
faisceau d'indices                             0          2
en mesure d'attribuer or d'imputer             1          2

IPv4 address                                   0          0
64-character hash                              0          0
defanged domain, name[.]tld                    0          1

CERT-FR alert ALE-012                    2026-10-12  day  0 after 12 Oct
Copeland XWEB bulletin                   2026-10-14  day  2 after 12 Oct
second wave and blood-service incident   2026-11-02  day 21 after 12 Oct
CISA and FBI fact sheet                  2026-11-05  day 24 after 12 Oct
French attribution                       2026-11-09  day 28 after 12 Oct

retailer counts in our 13 Oct report: 490 stores {'Intermarche and Netto': 300, 'Cooperative U': 80, 'Carrefour': 80, 'Monoprix': 30}
gap to the 'about 700 sites': 210

Both columns are zero for Danfoss, Copeland, Dixell, XWEB, any CVE identifier, the words for vulnerability or flaw, passwords and contractors. The report’s four Schneider Electric hits are the hydroelectric installations, the reconnaissance and the unit’s scripts for Schneider, Siemens and Rockwell equipment, and its one FOFA hit is the indicator above. The one defanged domain in the report belongs to the 2024 Olympics case. The phrase “faisceau d’indices” appears twice in the report and not in the ministry statement, while “en mesure d’attribuer” or “d’imputer” appears once in the statement and twice in the report. The day counts come from the dates in the sources above, and the 490-store tally is our own arithmetic from the retailer figures in our October 13 report.

Sources

• Déclaration d’attribution à l’Iran de cyberattaques visant la France (French Ministry for Europe and Foreign Affairs, November 9, 2026)
• CERTFR-2026-CTI-009, Activités cyber offensives ciblant la France menées par des acteurs iraniens liés au CGRI (CERT-FR, November 9, 2026; PDF)
• CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERT-FR, October 12 to 16, 2026)
• US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (CISA fact sheet, November 5, 2026) and the press release
• Recommandations pour une utilisation sécurisée des superviseurs XWEB (Copeland bulletin of October 14, 2026 and Dixell France guide)
• ICSA-26-057-10, Copeland XWEB and XWEB Pro (CISA, February 26, 2026) and Danfoss security advisories
• France blames Iranian hackers for supermarket attacks that sparked fires (BleepingComputer, November 9, 2026), Hackers disrupt refrigeration systems at European supermarkets (November 2) and Cyberattack disrupts blood storage refrigeration systems in France (November 4)
• RTL Belgium on the Belgian stores (November 2, 2026) and Coolworld Rentals cybersecurity update
• CISA Known Exploited Vulnerabilities catalog (JSON feed, version 2026.11.09)
• Attackers Forced Defrost at Hundreds of French Supermarkets Through Danfoss Controllers, and Danfoss Says Most Were End-of-Life (sxz.io, October 13, 2026)