Read more about the wave of cyber-attacks on refrigeration control systems in Europe:
- Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted
- French Supermarket Cyber-Attack Impacts More Refrigeration Controllers
- Cyber-Attack on Refrigeration Systems Hits Supermarkets Across Europe
Cold storage rooms in France's National Blood Service (EFS) were turned to a boiling temperature of 110°C (230°F) in a cyber-attack targeting temperature-controlled storage and refrigeration equipment provider Coolworld.
On November 3, French investigative weekly newspaper Le Canard enchaîné reported a new wave of attacks targeting refrigeration systems in France.
The outlet said unauthorized actors took control of some refrigeration controllers in EFS’s cold storage rooms in the night between November 1 and 2, notably in facilities in the Burgundy and Franche-Comté region, in east-central France.
These cold storage units host blood samples used for health monitoring but also plasma intended for transfusions. While they are typically kept at -30°C (-22°F), the newspaper reported some rooms hit up to 110°C (230°F). This does not mean the equipment or any blood samples reached these temperatures.
The refrigeration control systems of the affected EFS cold rooms are maintained by Coolworld, a Dutch temperature control rental company operating in France, Germany, Ireland, the Netherlands and the UK.
Coolword confirmed on November 4 it was "aware of the cybersecurity incident involving remote monitoring software used in refrigeration systems" and said it "responded promptly by implementing the appropriate measures," without sharing any details on those measures.
The company specified that only a limited number of Coolworld units were affected and added that "the vulnerability currently being reported in the media concerns a component supplied by a third-party provider and not directly controlled by Coolworld."
No Operational Impact on Blood Samples
The French Ministry of Health sought to reassure the public and told Le Canard enchaîné that the incident had caused no operational disruption because it had been detected in time.
According to the EFS, an on-call technician noticed an abnormal rise in temperature in the cold storage rooms overnight, allowing the issue to be identified before it could affect operations.
Speaking to French national news channel BFMTV, EFS president Frédéric Pacoud said that while the EFS “could have lost samples or bags of plasma intended to treat patients,” the early warning meant “there was no compromise to the safety of blood products.”
The EFS also told French media it notified the country's national cybersecurity agency (ANSSI). At this stage, nothing indicates that any EFS IT systems are impacted by the attack.
The EFS was approached for comment but had not responded at the time of publication.
Image credit: Igor Paszkiewicz / Shutterstock.com
Read more: France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack