Hackers reset France's blood storage temperatures to 110°C

Attackers changed temperature settings at refrigeration facilities run by France’s national blood service, the French Blood Establishment (EFS), according to the report. EFS said monitoring and alarm systems detected the anomalies quickly and that no blood samples or products were altered.

What happened at EFS facilities

The devastating news reached France on November 2nd, when unknown intruders attacked EFS storage facilities overnight. After breaching the automated refrigeration system, attackers reset the temperature setting to 110 °C, described as the boiling point. Normally, blood plasma is stored at -30 °C or colder. EFS later told Le Canard enchaîné, the publication that broke the story, that frozen plasma intended for transfusion was also involved, after earlier reports considered only donor samples retained for blood safety monitoring. EFS said in a press release shared with Le Parisien that anomalies were reported, resulting in an alteration of operating parameters of cold rooms equipped with the solution of the establishment's service provider. An on-call technician noticed rising temperatures and alerted response teams. EFS stated that no blood samples or products were altered due to the attack, and some stored products were transferred to other facilities.

Who may be behind it

EFS uses third-party contractor Coolworld to manage refrigeration systems. It is likely that attackers breached the contractor to access the EFS fridges with blood. So far, there has been no public briefing on the potential attackers and attack vectors. However, the attacks fit a pattern of recent attacks against European refrigeration systems that affected food providers. The incidents have raised concerns about growing hybrid threats to critical infrastructure amid heightened security tensions following Russia's 2022 invasion of Ukraine. Analysts have previously suspected Russia-aligned actors. Two hacktivist groups, NoName057(16) and Z-Pentest Alliance, have claimed shared responsibility for recent attacks on food stores in multiple European countries.

Wider risks across Europe

While supermarket chains and shop operators threw tons of rotted food across Europe, disruptions in healthcare may have more severe consequences, such as blood shortages or interrupted medical procedures. A vulnerability in the Danfoss AK-SM 800A controller was discovered at the beginning of August, leading to a spree of attacks. Danfoss issued patches to address security issues, but reportedly affected businesses were still using default passwords. The risk of similar attacks remains high, as many systems remain flawed. Forescout cybersecurity analysts identified nearly 13,000 refrigeration services still vulnerable across 99 countries, with many systems exposed in Italy and Greece.

Sources: Cybernews · The Register