A refrigeration equipment provider for the French Blood Establishment, Établissement français du sang – EFS, experienced a cybersecurity incident Monday where attackers were able to adjust temperature settings.
Hackers attempted to change refrigeration settings from approximately -30°C (-22°F) to 110°C (230°F), according to media reports.
To that end, the monitoring and control systems for cold storage units at three EFS sites ended up affected, EFS said in an advisory.
“These cold storage units – located at EFS preparation and distribution sites – house blood products awaiting delivery to healthcare facilities, as well as samples intended for EFS biobanks,” the company said in an advisory.
Rapid Attack Identification
“EFS’ monitoring and alarm systems enabled the rapid identification of these anomalies, allowing for necessary measures to be taken to ensure that no samples or blood products were compromised. Depending on the specific situation, the affected equipment was either brought under control – ensuring no impact on the products and samples – or taken offline; products stored in these units transferred to other facilities.”
Furthermore, EFS said no health-related impact ended up identified. Additionally, no blood products ended up lost in the incident. The items stored in the affected equipment – plasma units intended for transfusion and plasma units intended for fractionation (the manufacturing of medicinal products) – either ended up transferred or secured.
Continuity of collection and distribution operations remains guaranteed, ensuring service to patients, EFS said.
Additionally, officials mobilized EFS technical teams in coordination with the French National Cybersecurity Agency (ANSSI) and the Ministry of Health.
“Monitoring of the operation and temperatures of all our equipment has been stepped up,” EFS said.
“This incident represents a troubling escalation in an ongoing campaign,” said Damon Small, board member at security provider, Xcape, Inc. “Adversaries appear to be pivoting from disrupting food supplies in grocery stores to directly threatening patient care. We should expect these attacks to continue and potentially evolve from nuisance incidents into operations with much more harmful consequences.
“The fact that no group has claimed responsibility for these ongoing attacks in Europe and the United States is telling. This is not cyber vandalism; this is terrorism. As previously reported, the European countries targeted in this campaign share a common characteristic: They provided tangible support to Ukraine.
Authentication Needed
“Any device capable of affecting human safety connected to the Internet must have strong authentication and access controls,” Small said. “Access should end up restricted to authorized users through appropriate filtering and security mechanisms. These systems deserve the same level of protection as any other critical operational technology.”
“We’ve spent years telling organizations that third-party access is a security risk,” said Darin Fredde, senior director of technical marketing engineering at security provider, Ridge Security.We’re talking about blood plasma, that’s a very different kind of ransomware nightmare.
“What stands out isn’t simply that attackers reportedly manipulated refrigeration settings. It’s the architectural seam that allowed a compromise involving a third-party provider to affect systems responsible for maintaining critical medical supplies,” Fredde said. “That’s where the real security questions begin. What authority did that provider have? How was access controlled? Could you have prevented or constrained those changes before they reached the equipment?