Europe’s Freezers Keep Being Hit by Cyberattacks. A French Blood Bank Was Now Hit.
A cyberattack altered refrigeration controls at three French blood bank sites early Monday, prompting staff to secure equipment and move supplies before they lost any blood products or samples. The breach came as supermarkets across Europe faced similar situations, being forced to throw away food after hackers remotely tampered with their refrigerators and freezers.
The French Blood Establishment, known by its French initials EFS, said the attack reached its sites through an outside refrigeration supplier. The national blood service said it was not directly targeted. Attackers raised the thresholds that govern temperature and defrosting in some cold storage rooms, changing settings on equipment used to preserve products before they are delivered to hospitals and other health care facilities.
The affected rooms held frozen plasma intended for transfusions and for use in manufacturing medicines. They also held samples for the agency’s biobanks, which preserve biological material for future use. The agency said its monitoring and alarm systems detected the changes quickly enough for employees to intervene.
Staff regained control of some equipment and took other units out of service. In those cases, they transferred the contents to other storage as a precaution. EFS spokesperson Charley Dubois told Reuters that staff are on duty around the clock because blood can be needed at any time. When alarms sounded, employees moved supplies to refrigerators without a network connection.
The French Health Ministry said Wednesday that the situation was under control and that remote access to the affected equipment had been disabled. The blood service said it had stepped up monitoring and was coordinating with the ministry and France’s national cybersecurity agency, known as ANSSI. Blood collection and distribution continued without interruption, and the agency reported no health consequences from the breach.
Investigators are examining how the attack was carried out, which equipment may have been affected and when it can safely return to service, Reuters reported. Whether the same attackers were responsible for both the blood bank incident and the supermarket breaches remains unclear. No group has claimed responsibility for the latest attacks.
The supermarket incidents occurred around the same time, with Reuters reporting that stores in eight European countries had to discard food after their refrigeration systems were tampered with. One Swedish supermarket reported that its refrigerator and freezer controls had been set to 50 degrees Celsius, or 122 degrees Fahrenheit, according to The Associated Press. That figure described the setting entered into the controls.
Swedish grocery chain Coop said seven affected stores were operating again by Tuesday after disconnecting their refrigeration systems from the internet. In Belgium, 15 Carrefour stores were affected on Monday, Reuters reported. The French retailer had already dealt with an attack on refrigeration equipment at 80 franchised stores in France about three weeks earlier. French police said the October attacks caused fires and food losses.
The European Union Agency for Cybersecurity called for countries to share information quickly and coordinate their responses, given the number of markets affected. The attacks have exposed how remotely managed equipment can create an opening for disruption that extends from grocery stores to health care. At the French blood banks, the equipment at risk was part of the network that keeps donated products ready for patients.
