Hackers Alter Cold-Storage Settings at French Blood Service; No Plasma Lost

Attackers took remote control of refrigeration equipment at three plasma cold-storage sites run by France’s national blood service on Nov. 2 and pushed temperature and defrost settings to extreme levels, the French Blood Establishment, known as EFS, said in a statement.

Monitoring and alarm systems caught the change quickly, and no blood products or samples were compromised, the agency said. Blood collection and distribution continued without interruption.

A supplier, not the blood service, was breached

EFS said its own systems were not directly targeted. The intrusion went through a refrigeration equipment provider, according to the agency’s statement, as reported by BleepingComputer and The Register.

Dutch-based Coolworld Rentals confirmed that a security incident involving remote monitoring software affected a limited number of its refrigeration units, BleepingComputer reported. Coolworld told DW the weakness was in a component from a third-party supplier and was “outside Coolworld’s direct control.”

The settings were changed from about minus 30 degrees Celsius to about 110 degrees Celsius, the French weekly Le Canard Enchaîné first reported, according to DW and AP. The Register noted that a changed setting does not mean the chambers or their contents reached that temperature.

Plasma moved, remote access shut off

Bags of plasma for transfusion and plasma used to make medicines were moved to other facilities or secured, EFS said. A regional EFS official told France 3 that sites in Besançon were among those affected and that control was lost for only a few minutes.

The Health Ministry said remote access to the affected refrigerators has been disabled, DW reported. France’s national cybersecurity agency, ANSSI, and the ministry are investigating, and no one has been publicly identified as responsible.

AP reported that the incident follows remote takeovers of supermarket fridges and freezers in several European countries this week.

Developing: Investigators have not said who carried out the attack or how many pieces of equipment were affected in total.

Sources: French Blood Establishment (EFS), French Health Ministry, AP, DW, BleepingComputer, The Register, France 3.