News · Breach Analysis · Breaking

French blood service cold rooms hit in freezer hacks as theories swirl about the culprits

France's national blood service says hackers tampered with cold rooms storing blood. Staff intervened, no blood was lost, and researchers still disagree on who is responsible.

Mark FermorCTO, CMO and Founder, Firevault

Published 5 November 2026 · 4 min read

The freezer hacks that hit European supermarkets have reached healthcare. According to BBC News, the French Blood Establishment (Établissement français du sang, EFS) has confirmed that cold rooms used to store donated blood were affected by the same wave of cyber attacks.

The EFS said hackers set temperatures to rise, but staff intervened in time to protect supplies. "No health impact has been identified and no loss of blood products is to be reported," the EFS said.

Until this disclosure, only supermarkets were known to have been affected. We covered that earlier wave in Europe's supermarket cyberattacks.

What happened

The BBC reports that the attacks targeted refrigeration control software which was reachable from the internet and poorly protected, with known attack methods already circulating online. The entry point was not difficult to exploit.

Ryan Dewhurst of Spanish security company Previdian told the BBC that the second wave was planned rather than opportunistic. "The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," he said. The attackers would have needed to gather public IP addresses to build a target list, choose methods and time the attacks. Temperatures were reportedly raised overnight, which Dewhurst described as further evidence of co-ordination "for maximum damage".

What the honeypots showed

Three security firms deployed honeypots: fake freezer systems designed to attract attackers so their methods can be studied safely.

• Lupovis, based in Strathclyde, began seeing scanning and probing activity ten days before the second wave. Founder Dr Xavier Bellekens said only European honeypots were targeted: "We saw none of our honeypots in places like Africa or South America targeted at all. Even pots in Ukraine were left alone."
• Sekoia, the French cyber-defence firm, also saw scanning before the second wave, but said it could have been automatic scanning without malicious intent.
• Previdian gathered activity after the first wave and concluded the second wave was highly targeted.

Who is behind it?

No formal attribution has been made. The BBC reports that Russian hacktivist groups Noname057(16) and Z-Pentest Alliance claimed online that they had hacked Danfoss, one of the systems used in the attacks. That claim prompted speculation, but analysts question whether it links them to the supermarket attacks.

Sekoia told its customers that the activity could align with Russian hacktivists or the Russian state, which stands accused of "hybrid warfare" across Europe. Its research also points towards Iranian regime hackers or hacktivists. "Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems," the report said, noting that about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. In late August, freezers at at least six US military bases were reportedly forced into defrost mode; the controller models remain unconfirmed.

A Sekoia spokesperson told the BBC: "To date, we have no technical evidence indicating the involvement of Russian-speaking groups." The company added that NoName057 is not known to conduct operations beyond DDoS attacks and has a history of false attributions.

None of the three firms rules out a teenager. Given the planning involved, however, they agree a well co-ordinated group is more likely, and Sekoia says the three waves may have been carried out by different groups or copycats.

Why the blood service matters

A supermarket losing chilled stock is a commercial loss. A blood service losing stored blood is a patient-safety problem. The EFS incident shows that the same exposed controller can sit behind very different consequences, and that the outcome here depended on staff noticing and acting.

The questions for any organisation running temperature-controlled storage are practical:

• Is the refrigeration controller reachable from the internet, directly or through a vendor portal?
• Would an unauthorised setpoint change raise an independent alarm, separate from the system that was changed?
• Can staff take local manual control quickly, at night?
• Who is allowed to change settings remotely, and when?

Where physical disconnection helps and where it does not

Physical disconnection would not stop a person on site from changing a setting, and it does not replace monitoring, patching or vendor access controls. What it does address is the core weakness in these attacks: controllers left permanently reachable from the internet. If a control path is physically disconnected when it is not needed, it cannot be reached remotely.

That is the approach behind Control by Firevault, set out for clinical environments in the Healthcare Blueprint and for cold-chain operations in the Retail Blueprint.

Source

• BBC News: French blood storage impacted by freezer hacks as theories swirl about culprits, Joe Tidy, with additional reporting from Chris Vallance
• BBC News: Shop freezers in seven European countries hit by cyber-attack

Sources and reporting notes

1. bbc.co.ukPrimary reporting referenced in this analysis.

Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor.