Freezer hacks reach French blood banks

The French Blood Establishment, known as EFS, confirmed that cyber-attacks disrupted the cold rooms used to store donated blood. The intrusion forced temperatures to rise in several medical facilities. Staff members intervened manually to protect the inventory. The EFS stated that no health impact was identified and no blood products were lost.

The attacks represent a shift from previous incidents. Up to this point, only supermarkets had been confirmed targets of the freezer hacks. The cyber-attacks have affected European supermarket chains in recent waves. French authorities are now investigating the intrusion into the medical sector. This marks the first time medical facilities have been confirmed as victims of this specific type of attack.

Online rumors point to specific hacker groups. Two Russian hacktivist groups, Noname057(16) and Z-Pentest Alliance, posted online claiming they hacked Danfoss systems. These posts fueled speculation that the same actors behind the supermarket hacks targeted the blood banks. Analysts are questioning whether these groups were actually responsible for the broader supermarket cyber-attacks.

Experts say the list of suspects remains wide. Russian groups are not ruled out, but Iranian hacktivists or nation-state hackers are also possibilities. Some experts suggest the attacks could even be the work of teenagers pulling pranks. Cyber-security researchers are analyzing evidence from digital decoys to identify the attackers. These decoys, called honeypots, are set up to look like vulnerable targets.

Three separate cyber-security firms deployed fake freezer software traps. These traps allow experts to monitor hacker methods without risking real systems. Activity gathered after the first wave of attacks shows the second wave was highly targeted. Ryan Dewhurst, a researcher at Spanish firm Previdian, noted that the simultaneous hitting of fridge freezers suggests planning and coordination.

Dewhurst said the entry point to the freezer software was not difficult to exploit. The systems were poorly protected, and known attack methods were already available online. However, the hackers had to gather public IP addresses to create a target list. They also had to plan which methods to use and when to execute them. The timing of the temperature increases, which appeared to be overnight, supports the theory of a planned attack.

Lupovis, a firm based in Strathclyde, also deployed honeypots. Its team saw activity ten days before the second wave of attacks. The hackers scanned and probed fake freezer sites only in Europe. Dr. Xavier Bellekens, the founder of Lupovis, said no honeypots in Africa or South America were targeted. He noted that even decoys in Ukraine were left alone.

A third firm, Sekoia, observed similar scanning activity before the second wave. Sekoia said the activity could have been automatic scanning without malicious intent. In a report to customers, Sekoia stated the attack aligned with Russian hacktivists or the Russian government. The report also pointed to Iranian regime hackers. Sekoia noted that about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022.

In late August, freezers in at least six US military bases were forced into defrost mode. The controller models for those incidents remain unconfirmed. A Sekoia spokesperson said there is no technical evidence yet indicating the involvement of Russian-speaking groups. The firm expressed skepticism about the claims by Noname057, citing their history of false attributions and reliance on DDoS attacks.

Authorities in several countries are actively investigating the hacks. They are warning supermarkets about potential future attacks. No formal attribution has been made to any specific group. The three cyber firms gathering data are not ruling out that a teenager could be involved. However, experts agree the degree of planning required suggests a well-coordinated group. If so, they expect online bragging to surface soon.