French authorities have reported that cyber-attacks by unknown hackers impacted fridges used in medical facilities to store blood donations. The French Blood Establishment (EFS) stated that while hackers attempted to cause temperatures in the cold rooms to rise, staff intervened to protect the supplies. The EFS confirmed that "No health impact has been identified and no loss of blood products is to be reported."
Until now, only supermarkets were known to have been affected by the hacks. However, rumors have circulated online regarding Russian hacktivist groups claiming they worked together to hack one of the systems used in the attacks affecting European supermarkets. Specifically, Noname057(16) and Z-Pentest Alliance posted that they successfully hacked Danfoss, leading to speculation that they were the culprits behind the freezer hacks.
Analysts are currently questioning whether those claims mean the groups were behind the supermarket cyber-attacks. While Russian groups are not being ruled out, experts suggest that Iranian hacktivists, nation-state hackers, or even teenagers pulling pranks could be the culprits.
Cyber-security researchers at multiple firms are currently analyzing evidence from "honeypots"—digital decoys set up to lure and trap hackers—to identify the perpetrators. Three separate firms have deployed fake freezer software traps to monitor attack methods.
Ryan Dewhurst of the Spanish cyber-security company Previdian noted that the second wave of attacks, which hit several European countries, was highly targeted. "The fact that all these fridge freezers were hit simultaneously suggests planning and coordination," Dewhurst said. He explained that while the software was poorly protected and easy to exploit, the hackers had to gather public IP addresses to create a target list and plan the timing of the execution. Dewhurst added that the timing of the temperature increases, which appeared to happen overnight for maximum damage, is "further evidence that the attack was planned and co-ordinated."
The Strathclyde-based firm Lupovis deployed similar honeypots and observed activity 10 days before the second wave of attacks. Founder Dr Xavier Bellekens reported that hackers scanned and probed fake freezer sites only in Europe, noting that "We saw none of our honeypots in places like Africa or South America targeted at all," and that "Even pots in Ukraine were left alone."
French cyber-defence firm Sekoia also noticed scanning activity prior to the second wave, though they stated it could have been automatic scanning without malicious intent. In a report to customers, Sekoia stated that evidence suggested the attack aligned with the activity of Russian hacktivists or the Russian government, which is accused of carrying out "hybrid warfare" cyber-attacks across Europe. However, the report also pointed to Iranian regime hackers or hacktivists, noting that "Iranian-aligned actors have an established record of targeting internet-exposed industrial control systems and previous incidents involved the same equipment in Israel and the US - both adversaries of Iran."
Sekoia reported that approximately 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. Additionally, in late August, freezers in at least six US military bases were forced into defrost mode, similar to the situation in France.
A Sekoia spokesperson told the BBC that they have "no technical evidence indicating the involvement of Russian-speaking groups" to date. The spokesperson added that they "remain sceptical of their alleged claim of responsibility" because NoName057 is not known to effectively conduct operations beyond DDoS attacks and has a history of making false attributions.
Authorities in several countries are investigating the hacks and warning supermarkets of future risks, but no formal attribution has been made. While the three firms gathering honeypot data are not ruling out the possibility of a teenager being responsible, experts agree that the level of planning required would necessitate a well-coordinated group. Sekoia also stated the possibility remains that the three waves of attacks could have been carried out by different and distinct groups or copycats.
