Cyber-attacks on French blood storage freezers spark debate over who is behind the hacks

The French Blood Establishment, known as the EFS, has confirmed that cold rooms used to store donated blood were caught up in a wave of cyber-attacks on refrigeration systems. The hackers set the temperatures to rise, but staff stepped in to protect the supplies. "No health impact has been identified and no loss of blood products is to be reported," the EFS said.

Until now, only supermarkets were known to have been hit. The blood facilities are the first medical sites publicly linked to the freezer hacks, which have struck several European countries in more than one wave. No one has been formally blamed, and authorities in several countries are investigating while warning supermarkets to expect further attacks.

Online, rumours have pointed at Russia. The hacktivist groups Noname057(16) and Z-Pentest Alliance posted that they had successfully hacked Danfoss, whose controllers are among the systems involved, and that fed speculation they were behind the freezer attacks. Analysts now question whether a claimed breach of Danfoss means the groups carried out the supermarket attacks. Russian groups are not ruled out, but experts say Iranian hacktivists, nation-state hackers or even teenagers playing pranks could also be responsible.

Three cybersecurity firms have set up honeypots, which are fake freezer systems built to look vulnerable so that attackers reveal their methods without any real equipment at risk. Their data suggests the second wave was highly targeted. Ryan Dewhurst of the Spanish firm Previdian said that the simultaneous hits on all these freezers suggest planning and coordination. The software was poorly protected and known attack methods were already circulating online, so getting in was not hard. But Dewhurst said the attackers still had to collect the devices' public IP addresses to build a target list, then decide which methods to use and when. The temperature increases appear to have happened overnight, which he said pointed to an aim of maximum damage.

Lupovis, a firm based in Strathclyde, had honeypots that appeared to sit in locations around the world. It began seeing activity 10 days before the second wave, and the scanning and probing hit only its European decoys. "We saw none of our honeypots in places like Africa or South America targeted at all," said founder Dr Xavier Bellekens. "Even pots in Ukraine were left alone."

The French firm Sekoia also noticed scanning before the second wave, but said it could have been automated and not malicious. In a report to customers, it said the attack fits the activity of Russian hacktivists or the Russian government, which is accused of waging "hybrid warfare" cyber-attacks across Europe. But the same report points to Iranian state hackers or hacktivists. It noted that Iranian-aligned actors have a record of targeting internet-exposed industrial control systems, and that earlier incidents involved the same equipment in Israel and the US, both adversaries of Iran. According to Sekoia, about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. In late August, freezers at no fewer than six US military bases were forced into defrost mode, as in France, though the controller models there are unconfirmed and investigations continue.

A Sekoia spokesperson told the BBC: "To date, we have no technical evidence indicating the involvement of Russian-speaking groups." The spokesperson added that NoName057 is not known to operate effectively beyond DDoS attacks, which flood a service with traffic to knock it offline, and has a history of false attributions, so Sekoia remains sceptical of its claim.

None of the three firms rules out a teenager, but all agree that the planning involved would require a well-coordinated group. If so, they expect online bragging to surface soon. Sekoia adds that the three waves could have been carried out by different groups or copycats. For now, watch for any boasts from the perpetrators and for official findings from the investigating authorities.