French authorities reported that refrigerators used in medical facilities to store blood donations were impacted by recent cyber-attacks carried out by unknown hackers. The French Blood Establishment stated that cold rooms preserving blood supplies experienced temperature increases, though staff members intervened successfully to protect the resources.
Investigation into Suspected Hackers and Theories
Until now, only supermarkets were known to have been affected by the hacks, but online rumors have circulated regarding Russian hacktivist groups claiming joint responsibility for hacking a system involved in the supermarket attacks. Groups such as Noname057(16) and Z-Pentest Alliance posted claims that they successfully hacked Danfoss, leading to speculation that they were behind the freezer incidents. However, analysts question whether those claims indicate direct involvement in the cyber-attacks, while experts note that Iranian hacktivists, nation-state actors, or teenagers pulling pranks could also be responsible.
Cyber-security researchers at multiple firms are examining evidence gathered from digital decoys known as honeypots to identify the perpetrators. Three separate firms have deployed fake freezer software traps to monitor how hackers attempt exploitation. According to activity data from the first wave of cyber-attacks, a subsequent wave hitting several European countries appeared highly targeted. Ryan Dewhurst from the Spanish cyber-security company Previdian explained that the simultaneous targeting of the fridge freezers points to careful planning and coordination, noting that the timing of temperature increases overnight aimed for maximum damage.
Strathclyde-based Lupovis, another firm utilizing honeypot technology, observed hacking activity 10 days before the second wave, noting that probes targeted fake freezer sites exclusively in Europe while leaving locations in Africa, South America, and Ukraine untouched, according to founder Dr Xavier Bellekens.
Assessing Potential State Actors and Future Threats
French cyber-defence firm Sekoia also noticed scanning activity prior to the second wave, though it noted the activity could have been non-malicious automatic scanning. A report to Sekoia customers suggested the attacks aligned with the activity of Russian hacktivists or the Russian government, which faces accusations of conducting hybrid warfare cyber-attacks across Europe. Nevertheless, Sekoia’s research also implicates Iranian regime hackers, noting that Iranian-aligned actors have a history of targeting internet-exposed industrial control systems, including previous incidents involving identical equipment in Israel and the United States.
Sekoia pointed out that approximately 40 Israeli supermarkets running Danfoss controllers were compromised in 2022, and freezers at a minimum of six United States military bases were forced into defrost mode in late August, with controller models still unconfirmed as investigations continue. A Sekoia spokesperson told BBC News that no technical evidence currently indicates involvement by Russian-speaking groups, and expressed skepticism regarding NoName057’s claims due to the group’s history of false attributions and limitation to distributed denial-of-service attacks.
Authorities across multiple countries are actively investigating the hacks and issuing warnings to supermarkets regarding potential future attacks, while cyber-security firms continue analyzing honey pot data without ruling out the involvement of teenagers or copycat groups.
