French authorities say that fridges used in medical facilities to store blood for donations were impacted by recent cyber-attacks by unknown hackers, an escalation of a campaign that had until now hit supermarkets.

The French Blood Establishment (EFS) said cold rooms storing blood were impacted by hackers, with temperatures set to rise - but staff intervened to protect blood supplies. The agency said no health impact had been identified and no blood products were lost.

France's national blood service has said hackers accessed control systems and boosted temperatures at three cold stores stocking vital blood products. The EFS said temperature and defrosting thresholds had been raised to "very high levels" in the attack.

Why plasma storage matters

The EFS is France's public blood transfusion operator, collecting, testing, preparing and distributing products such as blood, plasma and platelets to more than 1,900 hospitals around the country. It supports more than a million patients a year.

That scale is what made the intrusion serious rather than symbolic. Plasma for transfusions and plasma used to manufacture medicines are held at low temperatures, and a sustained rise is enough to render a batch unusable.

According to CBS News, the EFS said in a statement released late Tuesday that "temperature and defrosting thresholds were raised to extremely high levels" on Monday at three of its cold-storage sites for plasma. The cyberattack hit a supplier of refrigeration equipment at three EFS sites, which is how the intruders reached the systems in the first place.

The agency said monitoring systems quickly detected the problem and allowed staff to act in time, and that collection and distribution operations continued without interruption. It has not published technical details of how the controllers were accessed.

The supermarket attacks

The blood service attack came as the temperatures of refrigerators and freezers in supermarkets in almost a dozen European countries soared, causing millions of euros of food damage. Retailers in Italy, Germany, Romania and the United Kingdom were targeted on Tuesday, after earlier incidents in Belgium, Estonia, Ireland, Finland, Luxembourg and the Netherlands.

Up until now, only supermarkets were known to have been impacted by the hacks. The move into medical cold storage is a different order of target: retail losses are financial, while a blood service failure would be a clinical event.

That difference is why the French case has drawn attention from governments rather than only from security researchers. Critical infrastructure has been connected to remote monitoring for years, and the same convenience that lets an operator check a temperature from a phone lets someone else change it.

Who might be behind it

Rumours have circulated online about Russian hacktivist groups claiming they worked together to hack one of the systems used in the attacks. Two groups, Noname057(16) and Z-Pentest Alliance, posted that they had successfully hacked Danfoss, a refrigeration controls supplier, which led to speculation that they were the culprits behind the freezer hacks.

Analysts now question whether that claim meant they were behind the supermarket cyber-attacks. Access to a supplier's systems is not the same as running the campaign, and researchers have been cautious about attributing the wave to any single actor.

Russian groups are not being ruled out, but experts say Iranian hacktivists or nation state hackers, or even teenagers pulling pranks, could also be the culprits. The EFS has not named a suspected attacker.

The honeypots watching

Cyber-security researchers at multiple firms are poring over evidence gathered from so-called honeypots to provide clues as to who is behind the waves of freezer hacks. In security work, a honeypot is a digital decoy - a fake computer network or file set up to look like a vulnerable target and lure attackers into revealing their methods.

Three separate cyber-security firms have deployed fake freezer software traps to monitor how hackers attempt to use them for attacks. Monitoring those traps lets researchers study an attacker's technique without exposing a real facility.

That work is slow and rarely produces a name quickly. It does produce something more useful in the short term: a picture of which control systems are being probed, and how easily they can be reached from the open internet.

What changes now

The immediate consequence is regulatory rather than criminal. A blood service that discovers its cold rooms can be reached remotely has to decide whether those controllers should be reachable at all, and how alarms should be configured so that a technician is woken rather than informed in the morning.

France's case also strengthens the argument that connected cooling equipment belongs in the same risk category as power and water infrastructure. The attack required no novel technique, only access to a supplier and a controller that accepted commands.

The EFS says there was no loss of product and no effect on patients. That is the outcome the system was designed for, and it is also a warning about how little margin sat between the alarm and the batch.

The day is moving on several fronts at once: the Binance-linked crypto hack that moved $6.3bn, North Korea denying involvement in a separate exchange breach and the global scramble after the PHP2Shell vulnerability.