French blood service says hackers raised temperatures at three cold stores

France's national blood service, the EFS, has said hackers accessed control systems and boosted temperatures at three cold stores stocking vital blood products. The Guardian describes it as an apparent escalation of recent cyber-attacks on fridges and freezers across Europe.

The EFS said temperature and defrosting thresholds had been raised to "very high levels", but its alarm systems allowed technicians to intervene before the products were compromised. The attack, the EFS said, happened overnight on Monday. The service is not the direct target, it says: the attacks hit cold stores run by its contractors. Products in the affected rooms, which included plasma bags for transfusions and medicine manufacturing, were moved to other sites. The EFS alerted France's national cybersecurity agency (ANSSI) and the health ministry, and reinforced monitoring of all its equipment.

The EFS is France's public blood transfusion operator. It collects, tests, prepares and distributes blood, plasma and platelets to more than 1,900 hospitals and supports more than a million patients a year.

The blood service attack came as temperatures in supermarket refrigerators and freezers in almost a dozen European countries soared as high as 50C (122F), causing millions of euros of food damage. Retailers in Italy, Germany, Romania and the UK were targeted on Tuesday, a day after Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems. In a wave of attacks in France last month, hackers seized control of cooling units in as many as 700 supermarkets. A regional branch of the French bank Crédit Mutuel said on Wednesday it had been the victim of a cyber-attack; the article does not link it to the fridge attacks.

Something similar may have happened in the US in early August, when mysterious fridge malfunctions hit commissaries at at least six military bases. The Pentagon is investigating a suspected hack.

After Italy's government held emergency talks with intelligence officials on Tuesday, EU spokesperson Thomas Regnier said the bloc's agencies were holding urgent discussions with national authorities to formulate a collective response. He declined to name any potential culprits. No motive is known and no one has claimed responsibility.

The Guardian notes that a growing range of devices, including commercial refrigeration systems, can be monitored and controlled remotely, and that without patching of emerging vulnerabilities, internet-connected software can leave code open to hackers. Some authorities and experts fear government-sponsored hybrid attacks following Russia's 2022 invasion of Ukraine, and Western intelligence officials say Moscow is waging a sabotage campaign in Europe that takes many forms. Rafe Pilling, senior director for threat intelligence at the cybersecurity company Sophos, told the Guardian this week that the most plausible attribution scenarios were a "state-based signalling and demonstration of capability" or a lone-wolf hacker.

Key facts

The EFS says hackers accessed control systems at three cold stores holding blood products and raised temperature and defrosting thresholds to "very high levels"; alarms let technicians intervene before the products were compromised.
The EFS says it was not directly targeted: the cold stores are run by its contractors. Products, including plasma bags, were moved to other sites, and ANSSI and the health ministry were alerted.
The same days saw supermarket fridges and freezers in almost a dozen European countries reach as high as 50C (122F), with millions of euros of food damage; last month hackers took over cooling units in as many as 700 French supermarkets.
No motive is known and no one has claimed responsibility; EU agencies are holding urgent talks with national authorities on a collective response.
Sophos's Rafe Pilling names a state-based signalling of capability or a lone-wolf hacker as the most plausible scenarios.

Why it matters

Until now the reported fridge attacks hit supermarkets and food stock. This one touched cold storage for blood products, which the EFS supplies to more than 1,900 French hospitals as part of work supporting more than a million patients a year. The Guardian calls it an apparent escalation. The EFS says the damage was stopped in time, so the significance lies in the target and the pattern, not in a confirmed loss of blood supply.

Who it affects

The EFS and the contractors running its cold stores are directly involved, along with the hospitals and patients that depend on blood, plasma and platelets. Supermarkets and retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, Sweden, Italy, Germany, Romania, the UK and France have reported refrigeration problems or attacks. EU agencies and national authorities, including Italy's government and ANSSI, are now coordinating a response.

How to use it

There is no product or tool here to use. The one practical point in the article is about maintenance: remotely controlled devices, including commercial refrigeration systems, can be exposed if emerging vulnerabilities are not patched. Operators of connected cold-chain equipment can take that as a cue to check patching and monitoring. The EFS's own response is a model of sorts: alarms that let technicians intervene, products moved to other sites, authorities alerted and monitoring of all equipment reinforced.

How solid is it

The attack on the blood service rests on the EFS's own statement as relayed by the Guardian, so the account of what the alarms caught is the EFS's version. The supermarket temperature figures and the earlier French wave of up to 700 supermarkets come from the Guardian's reporting. The US commissary incidents are only a suspected hack that the Pentagon is investigating. The article does not say the French supermarket wave, the Crédit Mutuel incident or the US incidents are confirmed as linked to the blood service attack. No one has been identified or has claimed responsibility.

Risks and caveats

The source does not say how the hackers got in, which systems or vendors were involved, where the three cold stores are or who the contractors are. It gives no actual temperatures for the blood stores, only "very high levels". Attribution is open: some authorities and experts fear government-sponsored hybrid attacks, and Western intelligence officials describe a Russian sabotage campaign in Europe in general terms, but the article does not attribute these attacks to Russia, and the EU spokesperson declined to name culprits. Pilling's two scenarios, a state-based signal or a lone-wolf hacker, are his assessment of what is most plausible, not a finding.

“These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents”

— Thomas Regnier, EU spokesperson