Hackers Target French Blood Storage Freezers in Remote Attack

Hackers remotely changed the temperature settings on freezer units holding blood plasma at French Blood Establishment facilities in Bourgogne-Franche-Comté overnight on Nov. 1, aiming the units at 110° Celsius instead of their normal -30° Celsius. Staff spotted the abnormal readings and acted in time: no blood products were lost and no health impact has been identified.

The attack, which went through cooling service provider CoolWorld, is the latest in a wave of freezer-related hacking incidents across Europe. French supermarkets were hit first, then retailers in Estonia, the Netherlands, Ireland and Sweden, where the attacks spoiled millions of euros’ worth of food. The blood-storage breach marks the first time medical cold rooms have been confirmed among the targets.

How staff stopped the Nov. 1 freezer attack

France’s Health Ministry says workers at the Bourgogne-Franche-Comté facilities noticed the abnormal temperature changes and reacted in time to prevent any loss of service. The 110° figure was the hackers’ target setting, not what the freezers actually reached, and the hack caused no major direct damage.

Hackers are targeting the refrigerators inside Europes blood banks

The French Blood Establishment told AP News simply: No blood products were lost, and in a separate statement said No health impact has been identified and no loss of blood products is to be reported, — two formulations of the same bottom line: the blood supply survived intact.

Why the simultaneous hits point to planning

The entry point was not hard to exploit. The affected freezer software products were poorly protected, with known attack methods already circulating online. But hitting many devices at once required preparation: the attackers had to gather the public IP addresses of the devices, build a target list, and decide which methods to use and when to execute them.

Ryan Dewhurst of Spanish cyber-security company Previdian, whose firm monitored the attacks, said The fact that all these fridge freezers were hit simultaneously suggests planning and coordination. He added that Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage – this is further evidence that the attack was planned and co-ordinated.

Honeypots show a Europe-only target list

Three separate cyber-security firms have deployed fake freezer software traps — “honeypots,” digital decoys designed to look like vulnerable targets — to study the attackers’ methods safely. Strathclyde-based Lupovis planted honeypots that appeared to be located around the world and began seeing activity 10 days before the second wave of attacks.

Hackers Target French Blood Storage Freezers in Remote Attack
Photo: pcmag.com

Yet the probing came from one direction only. We saw none of our honeypots in places like Africa or South America targeted at all, said Lupovis founder Dr Xavier Bellekens. Even pots in Ukraine were left alone. The second wave that hit several European countries was, by the activity gathered after the first wave, highly targeted.

Russian hacktivists claimed a hack — analysts are skeptical

Rumours circulating online have pointed at Russian hacktivist groups: Noname057(16) and Z-Pentest Alliance posted that they successfully hacked Danfoss, the company whose systems were used in the attacks, leading to speculation they were behind the freezer hacks. Analysts now question whether that claim means they were behind the supermarket cyber-attacks at all.

Cyberattack Targets French Blood Banks

While Russian groups are not being ruled out, experts say Iranian hacktivists or nation-state hackers — or even teenagers pulling pranks — could also be the culprits. Researchers at multiple firms are still poring over evidence from the honeypots for clues about who is behind the waves of freezer hacks.

The practical lesson is already being pushed by security professionals: Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, urged retailers across Europe to review their refrigeration units and controllers, identify vulnerabilities and upgrade security promptly. The tradeoff is real — connecting these systems to the internet lets equipment alert people when it breaks down so food and blood can be relocated before spoiling, but it also opens a door. In the blood-plasma incident, a prompt on-site staff response was enough to thwart the hack; who opened that door remains the open question.