French blood banks hit by cyber-attacks on freezer controls

Who is affected

French blood banks, specifically the French Blood Establishment (EFS), had cold storage rooms at three sites impacted by cyber-attacks on Monday, according to The Verge↗ (opens in a new tab) and BBC↗ (opens in a new tab). The attacks are part of a wider wave that has also affected supermarket freezers in at least seven European countries. The EFS said it was not directly targeted, but its refrigeration equipment provider was involved in the incident.

How the attack worked

Hackers accessed the software controlling the freezers, causing the temperature and defrosting thresholds to rise. This could have spoiled the stored blood. Staff detected the anomalies in time and intervened, so no blood was lost and there was no health impact, according to the EFS. Security researchers told the BBC↗ (opens in a new tab) that the entry points were poorly protected and that known attack methods were already available online. Attackers had to gather information about which devices were exposed to the internet and plan the timing for maximum disruption, often overnight.

Cybersecurity firms set up honeypots (fake freezer systems) to observe the attackers' methods. They saw scanning and probing activity focused on Europe, with no signs of similar attacks elsewhere. The second wave of attacks was described as highly targeted and coordinated.

Who is behind it

There is no confirmed culprit. Online rumours have pointed to Russian hacktivist groups like Noname057(16) and Z-Pentest Alliance, who claimed to have hacked a freezer controller manufacturer. However, experts are sceptical about these claims. Some researchers say the tactics could also fit Iranian-aligned groups or even teenagers. Sekoia, a French cybersecurity firm, said there is no technical evidence linking Russian-speaking groups to the attacks, and that Iranian actors have previously targeted similar equipment in other countries. The possibility remains that multiple groups or copycats are involved.

The response

The EFS said staff acted quickly to protect blood supplies, and no blood products were lost. Authorities in several countries are investigating and have warned supermarkets about the risk of future attacks. Cybersecurity firms continue to monitor the situation using honeypots to gather more evidence about the attackers' methods and origins.

What you should do

For organisations using internet-connected industrial equipment, experts recommend reviewing security controls, limiting public exposure of control systems, and monitoring for unusual activity. Staff should be trained to spot and respond to anomalies quickly, as early detection prevented damage in this case.