French blood storage impacted by freezer hacks as theories swirl about culprits

ByJoe Tidy Cyber correspondent, BBC World Service. 4 November 2026, 15: 19 GMT.

Key points

• According to Sekoia, regarding 40 Israeli supermarkets running Danfoss controllers were compromised back in 2022.
• Noname057(16) and Z-Pentest Alliance posted that they successfully hacked Danfoss which led to speculation that they were the culprits behind the freezer hacks.
• "We saw none of our honeypots in places like Africa or South America targeted at all, " remarked Lupovis founder Dr Xavier Bellekens.
• "The fact that all these fridge freezers were hit simultaneously suggests planning and coordination, " notes Ryan Dewhurst from Spanish cyber-security business Previdian.
• Another cyber firm which has deployed similar honeypot tech to lure the hackers into revealing their tactics is Strathclyde-based Lupovis.

French authorities say that fridges applied in medical facilities to store blood for donations were impacted by recent cyber-attacks by unknown hackers.

Notably, the French Blood Establishment (EFS) remarked cold rooms storing blood were impacted by hackers, with temperatures set to rise – but staff intervened to protect blood supplies.

"No health impact has been identified and no loss of blood products is to be reported, " the EFS remarked.

Up until now, only supermarkets were known to have been impacted by the hacks.

Meanwhile rumours have been circulating online regarding Russian hacktivist groups claiming they worked together to hack one of the systems that was employed in the attacks which have affected European supermarkets.

But analysts now question whether or not that meant they were behind the supermarket cyber-attacks.

While Russian groups are not being ruled out, experts say Iranian hacktivists or nation state hackers – or even teenagers pulling pranks – could additionally be the culprits.

Cyber-security researchers at multiple firms are poring over evidence gathered from so-called "honeypots" to provide clues as to who is behind the waves of freezer hacks.

Three separate cyber-security firms have deployed fake freezer software traps to monitor how hackers attempt to employ them for attacks.

In cyber-security, a "honeypot" is a digital decoy – such as a fake computer network or file – deliberately set up to look like a vulnerable target to lure and trap hackers.

By monitoring these traps, security experts can safely study an attacker's methods without putting real systems at risk.

According to activity gathered after the first wave of cyber-attacks, the second wave which hit a number of European countries was highly targeted.

Meanwhile, the entry point to the affected freezer software products was not tough to exploit as they were poorly protected, with known attack methods already floating around online.

But experts like Dewhurst say the hacker or hackers had to gather the information regarding the devices' public IP addresses to create a target list then take time to plan which methods to apply and when to execute them.

"Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage – this is further evidence that the attack was planned and co-ordinated, " he remarked.

It had honeypots which appeared to be located worldwide, and began seeing activity 10 days before the second wave of cyber-attacks.

Intriguingly, the team saw hackers scanning and probing their fake freezer sites only in Europe.

"We saw none of our honeypots in places like Africa or South America targeted at all, " remarked Lupovis founder Dr Xavier Bellekens. "Even pots in Ukraine were left alone."

In practice, a third firm – French cyber-defence firm Sekoia – additionally noticed scanning activity prior to the second wave of cyber-attacks, but noted it could have been automatic scanning without malicious intent.

In a report to its customers, it remarked evidence suggested the nature of the attack aligned with activity of Russian hacktivists or the Russian administration. It is being accused of carrying out so-called "hybrid warfare" cyber-attacks throughout Europe.

But Sekoia's research additionally points to Iranian regime hackers or hacktivists too.

"Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US – both adversaries of Iran, " the report remarked.

As in France, meanwhile in late August, freezers in at least six US military bases were forced into defrost mode. The controller models remain unconfirmed and investigations are ongoing.

"To date, we have no technical evidence indicating the involvement of Russian-speaking groups, " a Sekoia spokesperson informed the BBC.

"Furthermore, as NoName057 is not known to effectively conduct operations beyond DDoS attacks and has a history of making false attributions, we remain sceptical of their alleged claim of responsibility."

Distributed denial of service (DDoS) attacks work by flooding a website or online service with internet traffic in an attempt to throw it offline, or otherwise create it inaccessible.

Authorities in a number of countries are actively investigating the hacks and warning supermarkets concerning potential future attacks. But no formal attribution has been created.

None of the three cyber firms which have been gathering honey pot data are ruling out that it could be a teenager.

But with the degree of planning necessary the experts all agree it would have to be a well co-ordinated group – and if so, they would expect online bragging to surface shortly.

Sekoia additionally stated the possibility remains that all three waves could have been carried out by different and distinct groups or copycats. Extra reporting from Chris Vallance.

If hackers can take control of a supermarket freezer, how vulnerable is other tech? Shop freezers in seven European countries hit by cyber-attack.

Taken together, the developments around french blood storage impacted by freezer hacks as theories swirl about culprits point to a situation that is still moving, and the coming days should bring more clarity.