Blood banks in France were among the targets of cyberattacks that hit refrigeration systems in several European countries on Sunday and Monday, French authorities said on Wednesday. The French Blood Establishment (EFS) said a “cybersecurity incident” targeted a refrigeration service provider, affecting control systems at three cold storage sites for plasma and blood samples. According to French weekly Le Canard Enchaine, temperatures were programmed to reach 110 C (230 F) rather than -30 C (-22 F).
The EFS said monitoring and alarm systems quickly detected the anomalies and that no blood products were lost. Plasma in the affected units was transferred or secured, and distribution was not interrupted. The Health Ministry said remote access to the refrigerators has been disabled. France’s cybersecurity agency and Health Ministry said an investigation is underway but did not indicate who may be responsible. Coolworld, the equipment supplier, said the vulnerability came from a third-party component outside its direct control.
The incident coincided with a cyberattack on supermarket refrigeration in several European countries, including France and Germany, which destroyed large quantities of frozen food. A similar attack hit French supermarkets three weeks ago.
Source: AP, AFP, Reuters
So What
Attribution is the big unknown. Criminal extortion is possible, though the reporting mentions no ransom demand. It is also possible this is a Russian-backed hack as part of Moscow’s grey zone operations against Europe, though no public evidence confirms that yet. The most likely read is that one weak third-party component gave attackers access to many systems at once, so the blood banks may have been swept up rather than specifically chosen. Either way, it highlights the cybersecurity risks of non-critical infrastructure, where a remote-access flaw at a refrigeration vendor can become a public health risk.
Follow us to join the intelligence community!