French Blood Storage: Freezer Cyberattacks Hit Medical Facilities

Cyberattacks that previously targeted supermarket freezers across Europe have expanded to include medical facilities in France. French authorities confirmed that refrigeration systems holding donated blood were affected by the latest wave of these digital intrusions.

The French Blood Establishment, known as EFS, stated that cold rooms storing blood supplies were compromised. Attackers remotely adjusted the temperature settings to rise, but staff intervened in time to protect the inventory. The EFS reported that no health impact was identified and no loss of blood products occurred.

Online speculation has linked the attacks to Russian hacktivist groups. Noname057(16) and Z-Pentest Alliance claimed joint responsibility for breaching systems used in the supermarket attacks. They posted that they successfully hacked Danfoss, a manufacturer of the affected equipment. Analysts are questioning whether these claims prove involvement. While Russian groups have not been ruled out, experts suggest Iranian hacktivists, nation state hackers, or even teenagers could be responsible.

Cybersecurity researchers at three separate firms are analyzing data from honeypots. These are decoy systems designed to look like vulnerable freezer software to lure attackers. Evidence suggests the second wave of attacks, which hit several European countries, was highly targeted. Ryan Dewhurst of Spanish cybersecurity company Previdian noted that the simultaneous nature of the strikes suggests planning and coordination.

The affected software was poorly protected and easy to break into, with known attack methods available online. However, Dewhurst said hackers still had to gather public IP addresses, build target lists, and choose their timing. He pointed out that temperature increases occurred overnight to maximize damage, providing further evidence of a coordinated effort.

Lupovis, a cyber firm based in Strathclyde, deployed similar honeypot technology and observed activity 10 days before the second wave. Dr. Xavier Bellekens, the founder of Lupovis, stated that the scanning and probing only hit decoys in Europe. He noted that honeypots in Africa, South America, and Ukraine were left alone.

Sekoia, a French cyberdefence firm, also spotted scanning ahead of the second wave. The company cautioned that some activity might have been automatic rather than malicious. In a report to customers, Sekoia said the attack's nature aligned with the activity of Russian hacktivists or the Russian government. Their research also points toward Iranian regime hackers, noting that 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. In late August, freezers at at least six US military bases were forced into defrost mode, though the controller models in that case remain unconfirmed.

Sekoia remains unconvinced by the Russian claims circulating online. A spokesperson said there is no technical evidence indicating the involvement of Russian-speaking groups to date. The spokesperson added that NoName057 is not known for operations beyond DDoS attacks and has a history of false attribution claims. Authorities in several countries are investigating and warning supermarkets about possible future attacks, but no formal attribution has been made.

None of the three firms gathering honeypot data is ruling out a teenage prankster, though all agree the level of planning points to a well-coordinated group. If a group is responsible, they expect online bragging to surface soon. Sekoia also noted that all three waves of attacks could yet turn out to be the work of different groups or copycats.