Hackers Target French Blood Storage

Unknown hackers manipulated refrigeration systems at French medical facilities.

The French Blood Establishment, or EFS, confirmed that cold rooms holding donated blood were affected by the recent cyberattack wave. Attackers altered the temperature settings, causing the systems to warm up before staff intervened to protect the supplies. The EFS stated that no health impact was identified and no loss of blood products occurred.

This incident expands the scope of a campaign that previously targeted only supermarkets. Online speculation has linked Russian hacktivist groups to the breaches. Groups identified as Noname057(16) and Z-Pentest Alliance posted claims of successful hacks on Danfoss, the software provider for many of the affected freezers. Analysts are currently evaluating whether these claims prove direct involvement. Experts note that Iranian hacktivists, nation-state hackers, or even teenagers could be responsible.

Cybersecurity researchers at three separate firms are analyzing data from honeypots. These are decoy systems designed to mimic vulnerable freezer software to lure attackers and reveal their methods. Evidence collected after the first wave indicates the second wave, which struck several European countries, was highly targeted. Ryan Dewhurst of Spanish cybersecurity company Previdian noted that the simultaneous impact on multiple fridge freezers suggests planning and coordination.

The affected freezer software had weak protections, and known attack methods were already circulating online. However, Dewhurst explained that the hackers still had to gather public IP addresses, build a target list, and select specific timing. He pointed out that the temperature increases occurred overnight, a time chosen to maximize potential damage. This timing further supports the view that the attack was planned and coordinated.

Lupovis, a cyber firm based in Strathclyde, deployed similar honeypot technology. The company began seeing activity ten days before the second wave of attacks. Dr. Xavier Bellekens, the founder of Lupovis, stated that the scanning and probing hit only its decoys in Europe. He reported that honeypots located in Africa, South America, and Ukraine were not targeted.

French cyberdefence firm Sekoia also detected scanning activity ahead of the second wave. Sekoia cautioned that some of the activity may have been automatic rather than malicious. In a report to customers, the firm stated that the nature of the attack aligned with the activity of Russian hacktivists or the Russian government. Sekoia also pointed toward Iranian regime hackers, citing a 2022 compromise of about 40 Israeli supermarkets running Danfoss controllers. The firm noted that freezers at at least six US military bases were forced into defrost mode in late August, though controller models in that case remain unconfirmed.

Sekoia remains unconvinced by the Russian claims circulating online. A spokesperson told the BBC that there is no technical evidence indicating the involvement of Russian-speaking groups. The firm noted that Noname057 is known for distributed denial of service attacks and has a history of false attribution claims. Authorities in several countries are investigating and warning supermarkets about possible future attacks, but no formal attribution has been made.

None of the three firms gathering honeypot data is ruling out a teenage prankster. All three agree that the level of planning points to a well-coordinated group. They expect online bragging to surface soon if a specific group was responsible. Sekoia also stated that the three waves of attacks could yet turn out to be the work of different groups or copycats.