Freezer hacks reach French blood banks
Attackers targeted cold storage at medical facilities after supermarket systems were breached in a coordinated European cyber campaign.
By Noor Phillips ·
Donated blood stored in French medical facilities was affected by a cyberattack that caused refrigeration units to warm, according to the French Blood Establishment (EFS).
The EFS confirmed that cold rooms holding blood supplies were targeted by unknown hackers. Attackers adjusted the temperature settings, prompting staff to intervene to protect the inventory. The agency stated that no health impact was identified and that no blood products were lost.
The incident marks the second wave of attacks in a campaign that initially targeted supermarkets across Europe. The first wave disrupted retail cold storage systems, while the second wave expanded its reach to healthcare infrastructure in several countries.
Online rumors suggest that Russian hacktivist groups NoName057(16) and Z-Pentest Alliance claimed joint responsibility for breaching the Danfoss systems used in these attacks. However, analysts question whether this claim proves direct involvement. Experts note that Iranian hacktivists, nation-state actors, or even amateur teenagers could also be responsible for the disruption.
Cybersecurity researchers at three separate firms are analyzing data from honeypots, which are decoy systems designed to mimic vulnerable freezer software. Activity collected after the first wave indicates that the second wave was highly targeted. Ryan Dewhurst of the Spanish cybersecurity firm Previdian noted that the simultaneous impact on multiple fridge freezers suggests careful planning and coordination.
Dewhurst explained that while the affected freezer software was poorly protected, the hackers still needed to gather public IP addresses and build a target list. The timing of the attacks, which occurred overnight to maximize potential damage, further supports the theory that the operation was coordinated.
Lupovis, a cyber firm based in Strathclyde, deployed similar honeypot technology and detected activity ten days before the second wave. Dr Xavier Bellekens, the founder of Lupovis, stated that the scanning and probing hit only decoys located in Europe. He noted that honeypots in Africa, South America, and Ukraine were left alone during this period.
Sekoia, a French cyberdefense firm, also observed scanning activity ahead of the second wave but cautioned that some of it may have been automatic rather than malicious. In a report to customers, Sekoia stated that the nature of the attack aligned with the activity of Russian hacktivists or the Russian government, which is accused of waging hybrid warfare across Europe. The report also pointed toward Iranian regime hackers, citing the compromise of about 40 Israeli supermarkets running Danfoss controllers in 2022 and the defrost mode activation at six US military bases in late August.
A Sekoia spokesperson told the BBC that there is no technical evidence yet indicating the involvement of Russian-speaking groups. The firm added that NoName057 is not known for operations beyond DDoS attacks and has a history of false attribution claims. Authorities in several countries are investigating and warning supermarkets about possible future attacks, but no formal attribution has been made. All three firms agree the level of planning points to a well-coordinated group, though they have not ruled out the possibility that the three waves were the work of different groups.
