Freezer hackers reach French blood service cold rooms as Europe-wide attacks spread

France's national blood service, the French Blood Establishment (EFS), said on 4 November 2026 that cold rooms it uses to store donated blood were hit in the recent wave of cyber-attacks on refrigeration systems across Europe¹. The attackers set temperatures to rise, but staff stepped in and protected the stock¹. "No health impact has been identified and no loss of blood products is to be reported," the EFS said¹.

What is known about the attacks

Until the EFS statement, the only confirmed victims of the freezer hacks had been supermarkets¹. The blood service disclosure moves the campaign into healthcare infrastructure for the first time on the public record.

Researchers studying the attacks describe a deliberate operation rather than random vandalism. Ryan Dewhurst of the Spanish security company Previdian said the simultaneous hits "suggests planning and coordination"¹. He also pointed to temperatures being raised overnight as further evidence of a co-ordinated plan¹. The freezer software involved was poorly protected and could be entered with attack methods already circulating online, but the attackers still had to compile the devices' public IP addresses into a target list¹.

Three security firms have set up decoy freezer systems, known as honeypots, to watch how the attackers operate¹. Strathclyde-based Lupovis saw probing begin 10 days before the second wave, and only against decoys that appeared to sit in Europe¹. Its founder, Dr Xavier Bellekens, said: "Even pots in Ukraine were left alone."¹

Attribution is unresolved. Two Russian hacktivist groups, Noname057(16) and Z-Pentest Alliance, posted that they had hacked Danfoss, which fuelled speculation that they were responsible¹. The French cyber-defence firm Sekoia told the BBC it had "no technical evidence indicating the involvement of Russian-speaking groups", and its research also points towards Iranian state-linked hackers or hacktivists¹. Sekoia noted that about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022, and that freezers at no fewer than six US military bases were forced into defrost mode in late August¹.

What it means for health systems

The episode puts networked cold-chain equipment on the list of clinical assets that health systems need to secure. Blood services, hospital pharmacies and laboratories that rely on internet-connected refrigeration controllers face the same exposure the researchers describe: equipment reachable from the public internet, weak protection and attack techniques that are already known¹. In France the damage was contained because staff noticed and intervened, which points to monitoring and manual response as the last line of defence¹.

For suppliers of refrigeration and building controls, the attacks raise the question of how devices are configured and exposed once installed. The source does not identify which controller models were used against the EFS, and the models in the US base incidents remain unconfirmed¹.

Caveats

No formal attribution has been made, and authorities in several countries are still investigating¹. Sekoia said the three waves may have been the work of separate groups or copycats, and none of the three firms gathering honeypot data rules out a teenager acting alone, though all say the planning involved points to a co-ordinated group¹. The experts expect online bragging to surface soon if a group is responsible¹.