French blood storage hit by hacks; culprits still unknown
Officials say no blood has been lost, while researchers examine possible links to Russian and Iranian hacking groups.
Key points
- French Blood Establishment says cold rooms holding blood were hit by cyber-attacks, with temperatures set to rise.
- Staff intervened, and the agency reports no health impact and no lost blood products.
- Supermarket freezers in Europe were hit earlier by similar attacks.
- No formal attribution has been made, and several explanations remain open.
- Security firms are using decoy systems to study the hackers' methods.
French authorities say that fridges used by medical facilities to store donated blood were affected by recent cyber-attacks carried out by unknown hackers, according to BBC News. The French Blood Establishment, known as EFS, said cold rooms holding blood were tampered with and their temperatures were set to rise. Staff acted quickly to protect the supplies.
The agency said that no health impact has been identified and that no blood products have been lost. Until now, supermarkets were the only known victims of this wave of attacks, which has reached several European countries.
Read also: Cyber-attacks on fridges hit UK food suppliers
Who might be responsible
Online rumours have pointed to Russian hacktivist groups. Noname057(16) and Z-Pentest Alliance posted claims that they had breached Danfoss, a maker of the control systems involved. That claim led to speculation that the same groups were behind the freezer attacks.
Analysts are now questioning whether that claim proves anything about the supermarket incidents. Russian groups have not been ruled out, but experts also point to Iranian hacktivists, state-backed hackers and even teenagers playing pranks as possible culprits.
Sekoia, a French cyber-defence firm, told its customers that the attack pattern matched Russian activity, but it also noted links to Iranian-aligned actors. The firm said it had no technical evidence of Russian-speaking involvement. It also said it doubted the group’s claim, because NoName057 has not been known to carry out operations beyond denial-of-service attacks.
What the researchers have found
Several security firms have placed decoy systems, known as honeypots, to lure attackers and record their behaviour. Spanish firm Previdian and Strathclyde-based Lupovis are among those studying the data. Ryan Dewhurst of Previdian said the simultaneous hits suggested planning and coordination.
Dewhurst said the attackers would have needed to gather the public addresses of the devices and then choose when to strike. The devices were reportedly heated overnight, which he said would maximise damage. Entry points were not hard to exploit, because the products were poorly protected and known methods were already circulating online.
Lupovis founder Xavier Bellekens said its decoys, placed in several parts of the world, were probed only in Europe. He said none of the decoys in Africa or South America were targeted, and even those in Ukraine were left alone. Sekoia also saw scanning before the second wave, although it said this could have been automatic.
Why it matters
Authorities in several countries are investigating the incidents and warning supermarkets about possible future attacks. Earlier in the year, freezers at US military bases were reportedly forced into defrost mode in a similar way, according to the reports.
The experts consulted agree that a teenager cannot be ruled out. However, the level of planning suggests a well-organised group. If that is the case, they would expect the group to boast online soon. Sekoia also said the three waves could have been carried out by different groups or by copycats.
No formal attribution has been made, and investigations are ongoing. The controller models involved have not been confirmed.
Frequently asked questions
Were any blood supplies lost in the French fridge hacks?
The French Blood Establishment says no health impact has been identified and no blood products have been lost. Staff intervened to protect the supplies.
Who is behind the freezer cyber-attacks?
No formal attribution has been made. Russian hacktivist groups, Iranian-aligned actors and teenagers have all been mentioned by experts, but none has been confirmed.
Have supermarkets been affected by these hacks?
Yes. Supermarket freezers in several European countries were hit earlier, and authorities are warning shops about possible future attacks.
Sources
This article was written with the help of AI from reports by the outlets listed above. See our Editorial Policy. Spotted a mistake? Tell us.
