French authorities say that fridges used in medical facilities to store blood for donations were impacted by recent cyber-attacks by unknown hackers.
The French Blood Establishment (EFS) said cold rooms storing blood were impacted by hackers, with temperatures set to rise – but staff intervened to protect blood supplies.
“No health impact has been identified and no loss of blood products is to be reported,” the EFS said.
Up until now, only supermarkets were known to have been impacted by the hacks.
Meanwhile rumours have been circulating online about Russian hacktivist groups claiming they worked together to hack one of the systems that was used in the attacks which have affected European supermarkets.
Noname057(16) and Z-Pentest Alliance posted that they successfully hacked Danfoss which led to speculation that they were the culprits behind the freezer hacks.
But analysts now question whether or not that meant they were behind the supermarket cyber-attacks.
While Russian groups are not being ruled out, experts say Iranian hacktivists or nation state hackers – or even teenagers pulling pranks – could also be the culprits.
Cyber-security researchers at multiple firms are pouring over evidence gathered from so-called “honeypots” to provide clues as to who is behind the waves of freezer hacks.
Three separate cyber-security firms have deployed fake freezer software traps to monitor how hackers attempt to use them for attacks.
In cyber-security, a “honeypot” is a digital decoy – such as a fake computer network or file – deliberately set up to look like a vulnerable target to lure and trap hackers.
By monitoring these traps, security experts can safely study an attacker’s methods without putting real systems at risk.
According to activity gathered after the first wave of cyber-attacks, the second wave which hit several European countries was highly targeted.
“The fact that all these fridge freezers were hit simultaneously suggests planning and coordination,” says Ryan Dewhurst from Spanish cyber-security company Previdian.
The entry point to the affected freezer software products was not difficult to exploit as they were poorly protected, with known attack methods already floating around online.
But experts like Dewhurst say the hacker or hackers had to gather the information about the devices’ public IP addresses to create a target list then take time to plan which methods to use and when to execute them.
“Given the reported timing of when the devices had their temperatures increased, which seems to have been overnight for maximum damage – this is further evidence that the attack was planned and co-ordinated,” he said.
Another cyber firm which has deployed similar honeypot tech to lure the hackers into revealing their tactics is Strathclyde-based Lupovis.
It had honeypots which appeared to be located around the world, and started seeing activity 10 days before the second wave of cyber-attacks.
Intriguingly, the team saw hackers scanning and probing their fake freezer sites only in Europe.
“We saw none of our honeypots in places like Africa or South America targeted at all,” said Lupovis founder Dr Xavier Bellekens.
“Even pots in Ukraine were left alone.”
