Hackers accessed control systems at three cold-storage sites used by France’s national blood service and raised temperature and defrosting thresholds to very high levels. The intrusion occurred overnight on Monday and targeted facilities operated by contractors, rather than the blood service itself. Alarm systems alerted staff, who intervened before stored products were compromised. Plasma bags intended for transfusions and medicine production were transferred to other locations. The service, which collects, tests, prepares and distributes blood products to more than 1,900 hospitals and supports over a million patients annually, notified France’s cybersecurity agency and health ministry and increased monitoring of its equipment.
The incident comes amid a broader wave of attacks on internet-connected refrigeration systems across Europe. Supermarkets in nearly a dozen countries reported freezer and fridge temperatures spiking, while hackers reportedly took control of cooling units at as many as 700 French supermarkets the previous month. Similar unexplained failures at US military-base commissaries are under investigation. The attacks’ motive and perpetrators remain unknown, and no one has claimed responsibility. European authorities are coordinating a response; experts suggest possibilities ranging from a state-backed demonstration of capability to an individual hacker. The incidents highlight the risks of remotely controlled equipment left vulnerable by unpatched software, and raise concern that cyberattacks could disrupt essential services as well as damage food supplies.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US Commerce Department has delayed adding Singapore-based Megaspeed to a trade blacklist, despite concerns it helped smuggle Nvidia chips into China. Other agencies pushed for the listing, while Commerce said it needed more information about some companies under review. (ft.com)
Wyndham’s Android app contained a password that gave access to an internal database holding customer details, login tokens, and company files. Wyndham revoked the credential after a researcher reported it, but the company has not said how many records were exposed or whether customers will be notified. (techcrunch.com)
Seven months into Project Glasswing, Anthropic has logged 37,966 security findings but made only 217 fixes, while adding nearly 12,000 findings and just 15 fixes since September. Maintainers are also disputing many scanner reports, raising questions about the project’s claimed accuracy and the burden placed on open-source teams. (vulncheck.com)
rVPN is an open-source VPN protocol that disguises encrypted traffic as ordinary HTTPS to work around VPN blocking. It uses a Rust core, rotating encryption keys, and probe-resistant decoy responses, with code and builds available for verification. (rvpn.org)
CVE-2026-116928 is a remote code execution vulnerability in Windows Search. The provided information does not specify its cause, impact, or affected versions. (msrc.microsoft.com)
A flaw in OpenSSH on Alpine Linux and other musl-based systems can let attackers bypass password authentication with a single SSH connection. Install the security patch and restart OpenSSH; systems with password authentication enabled and no PAM are affected. (zdnet.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.