Hackers Got Into France's Blood Plasma Cold Rooms
by: Marcus Webb

Hackers Got Into France’s Blood Plasma Cold Rooms

France’s national blood service has confirmed that hackers reached the cold rooms holding its plasma. In a statement released late Tuesday, the Établissement français du sang (EFS) said “temperature and defrosting thresholds were raised to extremely high levels” on Monday at three of its sites, the Associated Press reported. Alarms caught it in time, and the EFS says no blood products or samples were lost. Nobody has claimed the attack, and the health ministry is still working out how many machines were exposed.

The breach came the same night as the second wave of supermarket fridge hacks. Le Canard Enchaîné, the French weekly that broke the story, dated it to the night of Nov. 1 to 2, according to Newsweek and Anadolu. In the same hours, retailers in Belgium, Luxembourg, Sweden, Ireland and Estonia were finding their freezers heating up, according to Reuters and Newsweek. No investigator has linked the two.

Plasma for transfusions, plasma for medicines

The EFS says it wasn’t the direct target. The attackers got into a refrigeration supplier that monitors and controls cold rooms at EFS sites, and through those systems changed the settings. The rooms held bags of plasma meant for transfusion, plasma bound for fractionation into medicines, and samples kept for the service’s biobanks, according to the EFS statement as quoted by franceinfo and CNBC.

Le Canard named the supplier as Coolworld, a company that maintains storage equipment for the EFS. Coolworld put out its own statement Wednesday without naming the EFS. It said the vulnerability being reported “relates to a component from a third-party supplier” that was outside its direct control, and that only a limited number of units were affected, the AP and franceinfo reported. It didn’t name the third party.

Only one site has been publicly identified. In the Bourgogne-Franche-Comté region, the affected site is Besançon, where the cold rooms are run remotely by the hacked supplier, the Radio France network ICI reported.

A setting of 110°C, or a reading?

The figure in most headlines is 110 degrees Celsius (230 Fahrenheit). Le Canard reported that the attackers ordered units normally kept at about minus 30°C to reach it, the AP and Newsweek reported. The tech site Clubic stressed that 110°C was the instruction sent to the machines, the temperature they were told to reach, not a measured one.

An EFS official went further. Christophe Barisien, the service’s director of collection and production in Bourgogne-Franche-Comté, told ICI the equipment keeps samples and blood products at minus 25°C, and that temperatures “rose to 110, even 150 degrees,” with no samples altered. The EFS statement itself gives no figure. Its temperature monitoring, which runs separately from the supplier’s controls, is what raised the alarm, Barisien said.

Staff then either took back control of the units or shut them down, and moved the plasma to other cold rooms as a precaution, the EFS said. Remote access to the affected equipment has been cut, ICI reported. Blood collection and hospital deliveries are running normally.

The EFS’s first account was narrower. According to Le Canard, as reported by Clubic, the service initially spoke of samples kept for health surveillance, before acknowledging that frozen plasma for transfusion was also in the rooms.

Three questions the ministry hasn’t answered

Health Minister Stéphanie Rist’s office said technical investigations are under way to establish three things: how the attack was carried out, the total number of devices potentially affected, and when the cold rooms can return to service, ICI reported. The ministry promised a further update once the findings are consolidated. It gave no indication of who might be responsible, according to the AP. The national cybersecurity agency, ANSSI, is working with the EFS.

The attackers’ method in the supermarket hacks is better documented. ANSSI’s alert, first published Oct. 12 and still being updated, lists compromised remote controllers from Danfoss (the AK-SM and AK-SC series), Copeland and Dixell, an ANSSI spokesperson told Newsweek. In mid-October about 700 of France’s 10,000 supermarkets were hit, according to the finance minister. No public account says which controller sat in the EFS cold rooms or whether the same method was used. Newsweek noted that the shared focus on refrigeration doesn’t establish a link.

The supermarket costs are starting to show up in earnings. Ahold Delhaize, one of the chains hit in October, said Wednesday the attack could cut its fourth-quarter sales by as much as 250 million euros, the AP reported.

The Pentagon’s freezer case

There is an American thread as well. The Pentagon is investigating freezer failures at about six military commissaries in August as a suspected cyberattack, a U.S. official told Nextgov, after Reuters first reported the probe. At Fort Huachuca in Arizona, a freezer went into defrost mode and heated its contents. Cyber Command and Defense Department law enforcement units are on the case, and French authorities are working with the investigators, Nextgov reported. The Pentagon hasn’t said what caused the failures or named a suspect.

A 2021 Department of Homeland Security assessment of threats to food and agriculture had flagged refrigeration failures as a cyber risk that could cause spoilage, Nextgov noted. The EFS case is the first publicly reported one in this run of attacks where the stock at risk was medical rather than food.

Our earlier coverage tracks the second-wave supermarket hacks country by country and the suspects in the October attack.

Sources:

Leave a Reply