Hackers altered temperature settings in cold rooms holding donated blood in France, extending a series of refrigeration cyber-attacks previously known to have affected supermarkets. Staff intervened to protect supplies, the French Blood Establishment (EFS) said.

“No health impact has been identified and no loss of blood products is to be reported,” the organisation said. Temperatures had been set to rise.

The incident brings medical storage into an investigation whose perpetrators remain unidentified. Authorities in several countries are investigating and warning supermarkets about further attacks, but no formal attribution has been made.

Three cyber-security companies have deployed “honeypots”: digital decoys resembling vulnerable refrigeration systems, which allow researchers to observe attempted attacks without exposing real equipment.

Their findings suggest preparation, though not necessarily a particular culprit. Ryan Dewhurst, of Spain-based Previdian, said simultaneous attacks and reports of overnight temperature increases pointed to planning and co-ordination. The software was poorly protected and attack methods were already available online, but attackers still needed to assemble devices’ public internet addresses and organise their operation.

Strathclyde-based Lupovis detected probing of its decoys 10 days before the second wave, which affected several European countries. Founder Dr Xavier Bellekens said only its European sites were targeted: decoys in Africa and South America saw no such activity, while those in Ukraine were also left alone. French cyber-defence firm Sekoia detected earlier scanning too, but cautioned that it could have been automated and without malicious intent.

Claims by Russian hacktivist groups Noname057(16) and Z-Pentest Alliance that they had jointly hacked Danfoss prompted speculation about responsibility. Sekoia, however, said it had no technical evidence implicating Russian-speaking groups. It questioned NoName057’s claim, citing its history of false attributions and operations generally confined to distributed denial-of-service attacks, which overwhelm online services with traffic.

Sekoia considered the attacks consistent with Russian hacktivist or state activity, amid accusations of Russian “hybrid warfare” across Europe. It also identified Iranian-aligned hackers as a possibility, citing their record of targeting internet-exposed industrial controls. About 40 Israeli supermarkets using Danfoss controllers were compromised in 2022, it said.

In late August, freezers at at least six US military bases were forced into defrost mode. Their controller models remain unconfirmed and investigations continue.

None of the three firms excludes teenagers, although the experts judge that the planning would require a well-co-ordinated group and expect online boasting to emerge. Sekoia also cautions that the three waves could involve separate groups or copycats. Evidence of organisation is not yet evidence of identity.