Overview
France's national blood service, the Établissement français du sang (EFS), confirmed that a cyberattack on a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products. EFS says it was not directly targeted; its supplier was.
What Happened
- The supplier was attacked on Monday, November 2, and the intrusion reached systems used to monitor and control its cold rooms.
- The affected rooms held plasma bags for transfusion, plasma for medicine manufacturing, and samples for the service's biobanks.
- EFS has not named the supplier. European refrigeration rental firm Coolworld Rentals said an incident involving remote monitoring software affected a limited number of its units.
- EFS monitoring and alarm systems detected the anomalies quickly. Products were transferred or secured, no health consequences were identified, and collection and distribution continued without interruption.
- France's national cybersecurity agency and the Health Ministry are investigating. No attribution has been made. Reporting links the incident to a series of suspected attacks on refrigeration equipment, including at European supermarkets.
Why It Matters
This is a textbook third-party and OT risk: attackers reached physical cold-chain controls through a vendor's remote monitoring platform. Independent alarms at the customer site were what prevented loss.
Recommendations
- Inventory vendor-managed remote monitoring and control platforms that can change setpoints on critical equipment.
- Keep independent, locally powered temperature alarms that do not depend on the vendor's cloud.
- Require MFA, network segmentation and audit logging for vendor remote access, and review contractual incident-notification terms.
- Rehearse manual failover procedures for cold storage and similar safety-critical systems.
Sources
- BleepingComputer
- France 24, CBS News, NBC News