French blood storage hit by cyber-attacks as hackers’ identity remains unclear

Hackers have targeted cold rooms used to store blood products in France, extending a series of refrigeration cyber-attacks beyond supermarkets into medical storage facilities.

The French Blood Establishment (EFS) said temperature settings had been altered to make the rooms warmer, but staff intervened to protect supplies. “No health impact has been identified and no loss of blood products is to be reported,” it said.

The attackers’ identity remains unknown. Online claims by Russian hacktivist groups have fuelled speculation, but cyber-security researchers say there is not enough technical evidence to establish who carried out the attacks.

Blood supplies protected

The EFS announcement broadens the known scope of the incidents, which had previously been reported as affecting supermarket refrigeration systems. Its statement distinguishes the attempted disruption of storage conditions from the outcome: staff protected the blood products, and the service reported no losses.

Authorities in several countries are investigating the refrigeration hacks and warning supermarkets about possible further attacks.

Decoy systems reveal signs of targeting

Three cyber-security companies have deployed fake refrigeration systems to study the attackers’ methods, according to BBC reporting. These digital decoys, known as honeypots, imitate vulnerable equipment so researchers can monitor attempts to access them without exposing real supplies.

Ryan Dewhurst, of Spanish cyber-security company Previdian, said the simultaneous targeting of fridge-freezers during a second wave of attacks across several European countries suggested planning and coordination.

The affected software was poorly protected, with methods for attacking it already available online. Even so, Dewhurst said the perpetrators would have needed to collect devices’ public internet addresses, build a target list and decide how and when to act.

He also pointed to reports that temperatures were increased overnight as further evidence of a planned operation.

Strathclyde-based Lupovis recorded activity against its decoys beginning 10 days before the second wave. Although its fake systems appeared to be located around the world, the company said scanning and probing focused on Europe.

French cyber-defence company Sekoia also detected scanning before that wave, but cautioned that such activity could have been automated and was not necessarily malicious.

Claims of responsibility remain unproven

Noname057(16) and Z-Pentest Alliance posted claims that they had successfully hacked Danfoss, whose controllers have been linked to refrigeration incidents. Those posts prompted speculation about their involvement, but do not establish responsibility for the supermarket attacks.

“To date, we have no technical evidence indicating the involvement of Russian-speaking groups,” a Sekoia spokesperson told the BBC.

The company said it remained sceptical of Noname057’s claim, citing its record of false attributions and its association with distributed denial-of-service attacks, which overwhelm online services with traffic.

Sekoia’s analysis considered both Russian-linked and Iranian-linked actors as possible explanations. It pointed to previous Iranian-aligned targeting of internet-exposed industrial control systems, but did not identify a culprit in the current incidents.

Researchers have not ruled out other perpetrators, including teenagers. Sekoia also cautioned that the different waves could be the work of separate groups or copycats rather than a single operation.

For France’s blood service, the confirmed outcome remains that staff intervention protected supplies. Establishing who altered the refrigeration settings—and whether the incidents share the same perpetrators—remains unresolved.