French blood storage impacted by freezer hacks as theories swirl about culprits

Image source, Getty ImagesByJoe TidyCyber correspondent, BBC World Service Updated 6 hours agoFrench authorities say that fridges used in medical facilities to store blood for donations were impacted by recent cyber-attacks by unknown hackers.

1. Published4 November 2026, 15:19 GMT.
2. Shop freezers in seven European countries hit by cyber-attack.

Se hackers podem controlar o freezer de um supermercado, quão vulnerável está a outra tecnologia? Publicado há 2 dias.

O Estabelecimento de Sangue Francês (EFS) afirmou que as câmaras frias que armazenam sangue foram impactadas por hackers, com as temperaturas previstas para subir — mas a equipe interveio para proteger os suprimentos de sangue.

No health impact has been identified and no loss of blood products is to be reported," the EFS said.

Up until now, only supermarkets were known to have been impacted by the hacks.

Meanwhile rumours have been circulating online about Russian hacktivist groups claiming they worked together to hack one of the systems that was used in the attacks which have affected European supermarkets.

Noname057(16) e Z-Pentest Alliance postaram que conseguiram hackear a Danfoss, o que gerou especulações de que eles seriam os responsáveis pelos hacks nos freezers.

But analysts now question whether or not that meant they were behind the supermarket cyber-attacks.

While Russian groups are not being ruled out, experts say Iranian hacktivists or nation state hackers - or even teenagers pulling pranks - could also be the culprits.

Pesquisadores de cibersegurança em várias empresas estão analisando minuciosamente evidências coletadas de chamados “honeypots” para fornecer pistas sobre quem está por trás das ondas de ataques a freezers.

Three separate cyber-security firms have deployed fake freezer software traps to monitor how hackers attempt to use them for attacks.

In cyber-security, a "honeypot" is a digital decoy - such as a fake computer network or file - deliberately set up to look like a vulnerable target to lure and trap hackers.

By monitoring these traps, security experts can safely study an attacker's methods without putting real systems at risk.

De acordo com a atividade coletada após a primeira onda de ataques cibernéticos, a segunda onda que atingiu vários países europeus foi altamente direcionada.

The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," says Ryan Dewhurst from Spanish cyber-security company Previdian.

The entry point to the affected freezer software products was not difficult to exploit as they were poorly protected, with known attack methods already floating around online.

Mas especialistas como Dewhurst dizem que o hacker ou os hackers tiveram que reunir as informações sobre os endereços IP públicos dos dispositivos para criar uma lista de alvos, depois levaram tempo para planejar quais métodos usar e quando executá‑los.

Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage - this is further evidence that the attack was planned and co-ordinated," he said.

Another cyber firm which has deployed similar honeypot tech to lure the hackers into revealing their tactics is Strathclyde-based Lupovis.

Ele possuía honeypots que pareciam estar localizados ao redor do mundo, e começou a observar atividade 10 dias antes da segunda onda de ataques cibernéticos.

Intriguingly, the team saw hackers scanning and probing their fake freezer sites only in Europe.

We saw none of our honeypots in places like Africa or South America targeted at all," said Lupovis founder Dr Xavier Bellekens.

Até mesmo panelas na Ucrânia foram deixadas sozinhas.

A third company - French cyber-defence firm Sekoia - also noticed scanning activity prior to the second wave of cyber-attacks, but said it could have been automatic scanning without malicious intent.

In a report to its customers, it said evidence suggested the nature of the attack aligned with activity of Russian hacktivists or the Russian government, which is being accused of carrying out so-called "hybrid warfare" cyber-attacks across Europe.

Mas a pesquisa da Sekoia também aponta para hackers ou hacktivistas do regime iraniano.

Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US - both adversaries of Iran," the report said.

De acordo com a Sekoia, cerca de 40 supermercados israelenses que utilizavam controladores Danfoss foram comprometidos em 2022.

Enquanto isso, no final de agosto, freezers em pelo menos seis bases militares dos EUA foram forçados a entrar em modo de descongelamento, como na França. Os modelos de controladores permanecem não confirmados e as investigações continuam em andamento.

To date, we have no technical evidence indicating the involvement of Russian-speaking groups," a Sekoia spokesperson told the BBC.

Além disso, como NoName057 não é conhecido por conduzir operações eficazes além de ataques DDoS e tem um histórico de fazer atribuições falsas, permanecemos céticos em relação à alegada reivindicação de responsabilidade deles.

Distributed denial of service (DDoS) attacks work by flooding a website or online service with internet traffic in an attempt to throw it offline, or otherwise make it inaccessible.

Authorities in several countries are actively investigating the hacks and warning supermarkets about potential future attacks.

Mas nenhuma atribuição formal foi feita.

None of the three cyber firms which have been gathering honey pot data are ruling out that it could be a teenager.

But with the degree of planning necessary the experts all agree it would have to be a well co-ordinated group - and if so, they would expect online bragging to surface soon.

Sekoia also said the possibility remains that all three waves could have been carried out by different and distinct groups or copycats.

Cobertura adicional de Chris Vallance.