--- title: "French blood service cold rooms hit in freezer… | Firevault" url: https://fire-vault.com/news/french-blood-service-freezer-hacks-2026 description: "France's national blood service says hackers tampered with cold rooms storing blood. Staff intervened, no blood was lost, and researchers still disagree on…" lang: en-GB --- Breaking News Updated as information becomes available Image: Blood bank cold room at night with refrigerated cabinets of blood bags and red temperature displays (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-blood-storage-freezer-hacks-2026.jpg) News · Breach Analysis · Breaking # French blood service cold rooms hit in freezer hacks as theories swirl about the culprits France's national blood service says hackers tampered with cold rooms storing blood. Staff intervened, no blood was lost, and researchers still disagree on who is responsible. Image: Mark Fermor, CTO, CMO and Founder of Firevault (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) **Mark Fermor**CTO, CMO and Founder, Firevault Published 5 November 2026 · 4 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffrench-blood-service-freezer-hacks-2026)Email The freezer hacks that hit European supermarkets have reached healthcare. According to BBC News, the French Blood Establishment (Établissement français du sang, EFS) has confirmed that cold rooms used to store donated blood were affected by the same wave of cyber attacks. The EFS said hackers set temperatures to rise, but staff intervened in time to protect supplies. "No health impact has been identified and no loss of blood products is to be reported," the EFS said. Until this disclosure, only supermarkets were known to have been affected. We covered that earlier wave in Europe's supermarket cyberattacks (https://fire-vault.com/news/europe-supermarket-refrigeration-cyberattacks-2026). ## What happened The BBC reports that the attacks targeted refrigeration control software which was reachable from the internet and poorly protected, with known attack methods already circulating online. The entry point was not difficult to exploit. Ryan Dewhurst of Spanish security company Previdian told the BBC that the second wave was planned rather than opportunistic. "The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," he said. The attackers would have needed to gather public IP addresses to build a target list, choose methods and time the attacks. Temperatures were reportedly raised overnight, which Dewhurst described as further evidence of co-ordination "for maximum damage". ## What the honeypots showed Three security firms deployed honeypots: fake freezer systems designed to attract attackers so their methods can be studied safely. - **Lupovis**, based in Strathclyde, began seeing scanning and probing activity ten days before the second wave. Founder Dr Xavier Bellekens said only European honeypots were targeted: "We saw none of our honeypots in places like Africa or South America targeted at all. Even pots in Ukraine were left alone." - **Sekoia**, the French cyber-defence firm, also saw scanning before the second wave, but said it could have been automatic scanning without malicious intent. - **Previdian** gathered activity after the first wave and concluded the second wave was highly targeted. ## Who is behind it? No formal attribution has been made. The BBC reports that Russian hacktivist groups Noname057(16) and Z-Pentest Alliance claimed online that they had hacked Danfoss, one of the systems used in the attacks. That claim prompted speculation, but analysts question whether it links them to the supermarket attacks. Sekoia told its customers that the activity could align with Russian hacktivists or the Russian state, which stands accused of "hybrid warfare" across Europe. Its research also points towards Iranian regime hackers or hacktivists. "Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems," the report said, noting that about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. In late August, freezers at at least six US military bases were reportedly forced into defrost mode; the controller models remain unconfirmed. A Sekoia spokesperson told the BBC: "To date, we have no technical evidence indicating the involvement of Russian-speaking groups." The company added that NoName057 is not known to conduct operations beyond DDoS attacks and has a history of false attributions. None of the three firms rules out a teenager. Given the planning involved, however, they agree a well co-ordinated group is more likely, and Sekoia says the three waves may have been carried out by different groups or copycats. ## Why the blood service matters A supermarket losing chilled stock is a commercial loss. A blood service losing stored blood is a patient-safety problem. The EFS incident shows that the same exposed controller can sit behind very different consequences, and that the outcome here depended on staff noticing and acting. The questions for any organisation running temperature-controlled storage are practical: - Is the refrigeration controller reachable from the internet, directly or through a vendor portal? - Would an unauthorised setpoint change raise an independent alarm, separate from the system that was changed? - Can staff take local manual control quickly, at night? - Who is allowed to change settings remotely, and when? ## Where physical disconnection helps and where it does not Physical disconnection would not stop a person on site from changing a setting, and it does not replace monitoring, patching or vendor access controls. What it does address is the core weakness in these attacks: controllers left permanently reachable from the internet. If a control path is physically disconnected when it is not needed, it cannot be reached remotely. That is the approach behind Control by Firevault (https://fire-vault.com/control), set out for clinical environments in the Healthcare Blueprint (https://fire-vault.com/control-blueprint/healthcare) and for cold-chain operations in the Retail Blueprint (https://fire-vault.com/control-blueprint/retail). ## Source - BBC News: French blood storage impacted by freezer hacks as theories swirl about culprits (https://www.bbc.co.uk/news/articles/c8vgxyvz6y9ro), Joe Tidy, with additional reporting from Chris Vallance - BBC News: Shop freezers in seven European countries hit by cyber-attack: https://www.bbc.co.uk/news/articles/cq1kd1nee80eo ## Questions No. The French Blood Establishment said staff intervened, no health impact was identified and no loss of blood products was reported. No formal attribution has been made. Russian hacktivist groups have made claims, but researchers including Sekoia say there is no technical evidence of Russian-speaking involvement, and Iranian-aligned actors or copycats remain possibilities. According to BBC News, the refrigeration control software was reachable from the internet and poorly protected, with known attack methods already available online. ## Sources and reporting notes 1. bbc.co.uk (https://www.bbc.co.uk/news/articles/c8vgxyvz6y9ro)Primary reporting referenced in this analysis. Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More breach analysis - Breach Analysis · 5 Nov 2026**Harvard breach: 851,000 email addresses linked to stolen alumni data**_Read the analysis_: https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026 - Breach Analysis · 4 Nov 2026**Bristol school data breach: 320,000 files published on the dark web**_Read the analysis_: https://fire-vault.com/news/bristol-schools-320000-files-dark-web-2026 - Breach Analysis · 4 Nov 2026**Accenture confirms security incident after hacker claims 35GB data haul**_Read the analysis_: https://fire-vault.com/news/accenture-35gb-source-code-breach-2026 - Breach Analysis · 2 Nov 2026**Europe's Supermarket Cyberattacks: Why Were the Refrigeration Systems Connected?**_Read the analysis_: https://fire-vault.com/news/europe-supermarket-refrigeration-cyberattacks-2026 - Breach Analysis · 2 Nov 2026**Pentagon breach exposes records of 2.76 million military personnel**_Read the analysis_: https://fire-vault.com/news/pentagon-dmdc-personnel-data-breach-2026 - Breach Analysis · 2 Nov 2026**Amadeus breach exposes airline passenger records across Asia**_Read the analysis_: https://fire-vault.com/news/amadeus-airline-reservation-data-breach-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Image: Offline Secure Storage icon (https://fire-vault.com/__l5e/assets-v1/a78723d3-5b1a-48bf-9040-c767b759823d/oss-icon-correct.png) Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Image: Control by Firevault icon (https://fire-vault.com/__l5e/assets-v1/9c97df8c-bca8-45bc-86f3-ec698db3afe8/control-icon.png) Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026#webpage", "url": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026", "name": "French blood service cold rooms hit in freezer…", "description": "France's national blood service says hackers tampered with cold rooms storing blood. Staff intervened, no blood was lost, and researchers still disagree on…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-blood-storage-freezer-hacks-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "French blood service cold rooms hit in freezer hacks as theories swirl about the culprits", "item": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "French blood service cold rooms hit in freezer hacks as theories swirl about the culprits", "description": "France's national blood service says hackers tampered with cold rooms storing blood. Staff intervened, no blood was lost, and researchers still disagree on who is responsible.", "url": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-blood-storage-freezer-hacks-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-blood-storage-freezer-hacks-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-blood-storage-freezer-hacks-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-blood-storage-freezer-hacks-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-11-05T09:33:02.329677+00:00", "dateModified": "2026-11-05T09:33:02.329677+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/french-blood-service-freezer-hacks-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 779, "keywords": "French, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "The freezer hacks that hit European supermarkets have reached healthcare. According to BBC News, the French Blood Establishment (Établissement français du sang, EFS) has confirmed that cold rooms used to store donated blood were affected by the same wave of cyber attacks. The EFS said hackers set temperatures to rise, but staff intervened in time to protect supplies. \"No health impact has been ide", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Was any blood lost in the French freezer hacks?", "acceptedAnswer": { "@type": "Answer", "text": "No. The French Blood Establishment said staff intervened, no health impact was identified and no loss of blood products was reported." } }, { "@type": "Question", "name": "Who carried out the freezer hacks?", "acceptedAnswer": { "@type": "Answer", "text": "No formal attribution has been made. Russian hacktivist groups have made claims, but researchers including Sekoia say there is no technical evidence of Russian-speaking involvement, and Iranian-aligned actors or copycats remain possibilities." } }, { "@type": "Question", "name": "How did the attackers reach the freezers?", "acceptedAnswer": { "@type": "Answer", "text": "According to BBC News, the refrigeration control software was reachable from the internet and poorly protected, with known attack methods already available online." } } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```