Blood bank freezers in France were targeted by hackers who raised temperature settings at three plasma cold-storage sites, in the latest cyberattack on refrigeration systems across Europe.
France’s national blood service, the Établissement français du sang (EFS), said hackers reached the equipment through a refrigeration supplier and pushed temperature and defrosting thresholds to very high levels. The attack took place overnight between 1 and 2 November. Alarms flagged the change, and staff moved the plasma to safety before any products were harmed.
The blood bank said no blood products were lost and no health consequences have been identified. Blood collection and distribution carried on without interruption, and the service continued to supply more than 1,900 hospitals around France. France’s national cybersecurity agency and the Health Ministry are investigating the incident.
Blood bank alarms catch the change
The blood bank attack hit cold stores run by contractors, not the blood service’s own systems. EFS said it was not directly targeted, and the attack reached equipment run by its refrigeration supplier. The supplier, Coolworld, provides refrigerated containers, temperature-controlled storage and maintenance services. An on-call EFS technician noticed temperatures climbing during the night and raised the alarm.
Some reports put the new setpoint as high as 110 degrees Celsius, against a normal storage temperature of minus 30 degrees. Officials have not confirmed how hot the units became, and the 110 degree figure describes a reported controller setting, not a measured temperature inside the freezers. The authorities have not disclosed how many installations were affected, how long the disturbance lasted, or the temperatures recorded inside the stored products.
Blood bank attack follows supermarket freezer wave
The incident followed a wave of refrigeration attacks across Europe. Supermarkets in almost a dozen European countries reported this week that their refrigerators and freezers had warmed after being remotely taken over, spoiling tonnes of food at a combined cost of millions of euros. Retailers in Italy, Germany, Romania and the United Kingdom were targeted on Tuesday, after Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems the day before.
Hundreds of French supermarkets were hit on 12 October, and further incidents were reported across six European countries on 2 November. France’s cybersecurity agency issued an alert on 12 October about compromises involving Danfoss, Copeland and Dixell refrigeration controllers. No public evidence connects the blood bank incident to those operations, and the authorities have not established whether the attacks on commercial refrigeration and the French blood facilities are linked.
Blood bank services continue
The blood bank attack targeted equipment that keeps plasma frozen, not a donor database or a hospital records system. No theft of donor information has been reported, and no plasma was destroyed, no transfusion was compromised and no patient was harmed, according to the available reporting. Fresh frozen plasma must be stored at or below minus 25 degrees Celsius, so a long break in the cold chain could have made the products unusable.
The blood bank incident is now under control, the French Health Ministry said, and is being closely monitored. Investigators are examining how the attack was carried out, which equipment may have been compromised and when affected systems can safely return to normal. Sites in the Bourgogne-Franche-Comté region were among those affected, according to the weekly Le Canard enchaîné, but EFS has not named individual facilities in its statements.
A regional branch of France’s Crédit Mutuel bank said on Wednesday it had also been the victim of a cyberattack. The bank said attackers came through a service provider’s platform and moved money from the bank’s own account. The investigator ZachXBT estimates the loss at more than 133 million dollars, and the bank backs only the order of magnitude. The bank said customer accounts were not accessed. No motive for the attacks is known, and no group has claimed responsibility.
This is the first time a healthcare victim has been reported in the wave of refrigeration attacks, according to coverage of the incidents. The blood bank case shows how connected equipment that controls physical processes can become a target, even when the computers holding patient records are untouched. The service collects, tests, prepares and distributes blood, plasma and platelets across France.