French blood storage impacted by freezer hacks as theories swirl about culprits
The French Blood Establishment (EFS) said cold rooms storing blood were impacted by hackers.
French authorities say fridges used in medical facilities to store blood for donations were affected by recent cyber-attacks carried out by unknown hackers.
The French Blood Establishment (EFS) said cold rooms storing blood were hit by hackers, with temperatures set to rise, but staff stepped in to protect blood supplies.
"No health impact has been identified and no loss of blood products is to be reported," the EFS said.
Until now, only supermarkets were known to have been affected by the hacks.
Meanwhile, rumours have been spreading online about Russian hacktivist groups claiming they worked together to hack one of the systems used in the attacks that have hit European supermarkets.
Noname057(16) and Z-Pentest Alliance posted that they successfully hacked Danfoss, prompting speculation that they were behind the freezer hacks.
But analysts now question whether that means they were behind the supermarket cyber-attacks.
While Russian groups are not being ruled out, experts say Iranian hacktivists or nation-state hackers - or even teenagers playing pranks - could also be responsible.
Cyber-security researchers at several firms are examining evidence collected from so-called "honeypots" to find clues about who is behind the waves of freezer hacks.
Three separate cyber-security companies have set up fake freezer software traps to watch how hackers try to use them for attacks.
In cyber-security, a "honeypot" is a digital decoy - such as a fake computer network or file - deliberately created to look like a vulnerable target in order to lure and trap hackers.
By monitoring these traps, security experts can safely study an attacker’s methods without putting real systems at risk.
Based on activity gathered after the first wave of cyber-attacks, the second wave that struck several European countries appears to have been highly targeted.
"The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," says Ryan Dewhurst from Spanish cyber-security company Previdian.
The entry point into the affected freezer software products was not hard to exploit because they were poorly protected, with known attack methods already circulating online.
But experts like Dewhurst say the hacker or hackers had to collect information about the devices' public IP addresses to build a target list, then spend time deciding which methods to use and when to launch them.
"Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage - this is further evidence that the attack was planned and co-ordinated," he said.
Another cyber firm using similar honeypot technology to lure hackers into revealing their tactics is Strathclyde-based Lupovis.
It had honeypots that appeared to be located around the world, and began seeing activity 10 days before the second wave of cyber-attacks.
Notably, the team saw hackers scanning and probing their fake freezer sites only in Europe.
"We saw none of our honeypots in places like Africa or South America targeted at all," said Lupovis founder Dr Xavier Bellekens.
"Even pots in Ukraine were left alone."
A third company - French cyber-defence firm Sekoia - also detected scanning activity before the second wave of cyber-attacks, but said it may have been automatic scanning without malicious intent.
In a report to its customers, it said the evidence suggested the attack pattern matched activity by Russian hacktivists or the Russian government, which is accused of carrying out so-called "hybrid warfare" cyber-attacks across Europe.
But Sekoia's research also points to Iranian regime hackers or hacktivists as well.
"Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US - both adversaries of Iran," the report said.
According to Sekoia, about 40 Israeli supermarkets using Danfoss controllers were compromised in 2022.
Meanwhile, in late August, freezers at at least six US military bases were forced into defrost mode, as in France. The controller models remain unconfirmed and investigations are ongoing.
"To date, we have no technical evidence indicating the involvement of Russian-speaking groups," a Sekoia spokesperson told the BBC.
"Furthermore, as NoName057 is not known to effectively conduct operations beyond DDoS attacks and has a history of making false attributions, we remain sceptical of their alleged claim of responsibility."
Distributed denial of service (DDoS) attacks work by flooding a website or online service with internet traffic in an attempt to knock it offline, or otherwise make it inaccessible.
Authorities in several countries are actively investigating the hacks and warning supermarkets about possible future attacks.
But no formal attribution has been made.
None of the three cyber firms gathering honeypot data are ruling out the possibility that it could be a teenager.
But given the amount of planning required, the experts all agree it would have to be a well-coordinated group - and if so, they would expect online bragging to appear soon.
Sekoia also said it remains possible that all three waves were carried out by different and distinct groups or copycats.