French blood storage facilities hit by freezer hack amid wider European attacks
French medical cold rooms were compromised by a cyber‑attack that raised freezer temperatures, but staff prevented any loss of blood products.
Freezer hack reaches French blood banks
The French Blood Establishment (EFS) announced that cyber‑attackers accessed the cold rooms used to store donated blood, causing the temperature settings to rise. Staff intervened quickly, preventing any loss of blood products and reporting that no health impact has been identified.
Earlier attacks limited to supermarkets
Prior to this incident, only supermarket freezers were known to have been affected by the same wave of hacks across several European countries.
Online claims and speculation
Rumours online cite Russian hacktivist groups, including Noname057(16) and Z‑Pentest Alliance, claiming they breached Danfoss systems used in the attacks. Analysts caution that these claims do not prove involvement in the supermarket or blood‑bank incidents.
Who might be behind the attacks?
Experts say the perpetrators could be Russian hacktivists, Iranian state‑linked actors, or even teenagers pulling pranks. No formal attribution has been made, and investigators in several countries are warning supermarkets of possible future incidents.
Honeypot research sheds light on tactics
Three cybersecurity firms deployed fake freezer software—known as honeypots—to attract and study the attackers without risking real systems.
Prevention researchers noted that the second wave of attacks was highly targeted, with simultaneous temperature changes suggesting coordinated planning.
Ryan Dewhurst of Spanish firm Previdian said the entry points were poorly protected, but the attackers had to gather public IP addresses and schedule the overnight temperature spikes.
Strathclyde‑based Lupovis observed scanning activity only on European honeypots, with none detected in Africa, South America, or even Ukraine.
French firm Sekoia reported scanning that could be automated, but also highlighted patterns consistent with Russian or Iranian actors, noting past compromises of Danfoss controllers in Israeli supermarkets in 2022.
Official statements and ongoing investigations
Sekoia told the BBC that it has no technical evidence linking Russian‑speaking groups to the attacks and expressed skepticism toward NoName057’s claim of responsibility, noting the group’s history of false attributions and focus on DDoS attacks.
In the United States, freezers at at least six military bases entered defrost mode in late August, though the specific controller models remain unconfirmed and investigations continue.
Potential motives and future risk
While the attacks appear to require coordination, experts agree that a well‑organized group would likely boast online if successful. However, Sekoia cautions that each wave could involve different actors or copycats.
Authorities across several nations continue to investigate and advise supermarkets and other facilities to monitor freezer systems for unusual activity.
