France's blood service says hackers reprogrammed cold rooms holding transfusion plasma
The Établissement français du sang confirmed on 3 November that attackers got into a contractor's control system and pushed temperature and defrost limits to very high values at three sites storing plasma. It was caught in time and nothing was lost. It happened the same night as the supermarket fridge attacks across Europe.
The wave of attacks on refrigeration systems that warmed up supermarket fridges across Europe did not stop at the dairy aisle. The Établissement français du sang (EFS), the French public body that collects and supplies blood, has confirmed that hackers tampered with cold rooms at three of its sites, where bags of plasma were being stored.
It happened on the night of 1 to 2 November, the same night seven Intermarché stores in Portugal and dozens of supermarkets in Belgium, Ireland and Sweden saw their freezers warm up with nobody touching a button.
What happened in the cold rooms
The EFS’s own systems were not hit. The attackers got into the control system of an outside contractor that runs the cold rooms, and from there raised the temperature and defrost limits to very high values. In effect, they told the rooms to stop freezing.
The plasma kept there is used for transfusions and to make blood-derived medicines. According to franceinfo, the attack had no impact on the stored samples. The anomalies were spotted in time, the bags were moved or secured, and no product was lost. France’s health ministry says the service carried on as normal.
Supermarkets, blood and the same weak spot
Nobody has yet established a technical link between the EFS case and the supermarket attacks. The pattern is hard to miss, though: in both, the target was not the organisation itself but whoever manages its cooling remotely.
France had a warning. In October, more than two hundred supermarkets had their refrigeration switched off remotely. Afterwards CERT-FR, the incident-response team of the French cybersecurity agency, advised taking vulnerable equipment off the internet, and warned that a factory reset is not enough: an end-of-life device with no security updates stays exposed.
The obvious question for Portugal is about its own blood stocks. The national blood and transplant institute (IPST) and hospitals also keep plasma in controlled cold storage, often maintained by outside firms. There is no sign they were targeted. But the lesson of the past week is that a maintenance contract can be a way in.
By Oliver Grant
Image: Sebleouf / Wikimedia Commons (CC BY-SA 4.0)
