Hackers Tried to Boil French Blood Banks. It Almost Worked.
Someone attempted to destroy thousands of bags of blood plasma last Monday by remotely hijacking the refrigeration systems at three French blood bank sites and cranking the temperature targets from minus 30 Celsius to 110 Celsius. That is not a typo. From frozen storage to the temperature of a domestic oven, via a cyberattack.
The French Blood Establishment, known as EFS, confirmed the incident Tuesday. Monitoring systems caught the anomaly fast enough for staff to intervene, and the organisation says no plasma was lost and no health consequences resulted. Blood collection and distribution continued without interruption. Lucky, rather than clever.
The actual attack vector was a supplier of refrigeration equipment called Coolworld, which is now doing the classic third-party-vendor shuffle. Its statement acknowledged the incident but was careful to point out that the exploited vulnerability belonged to a component from one of its own suppliers, making it technically not Coolworld's fault. Whether that defence holds up under scrutiny from France's national cybersecurity agency and Health Ministry, both of which are now investigating, remains to be seen.
This is not an isolated incident. It follows a wave of similar attacks on commercial refrigeration systems across France, Belgium and the Netherlands in mid-October, which hit supermarkets and independent retailers hard. Dutch chain Ahold Delhaize, one of the affected operators, disclosed this week that it expects the attack to knock up to 250 million euros off its fourth-quarter sales and shave as much as 100 million euros from operating income. CEO Franz Muller described it as the "harsh reality of doing business today," which is a polished way of saying their internet-connected freezers got pwned and it cost them a quarter of a billion euros.
The pattern here is fairly obvious. Industrial control systems managing refrigeration infrastructure, whether in supermarkets or medical storage facilities, are connected enough to be managed remotely and apparently not secured well enough to prevent hostile actors from doing the same. The consequences range from spoiled food to, in a worst case, destroyed blood products and medicines that cannot be quickly replaced.
The French blood bank attack is a useful reminder that critical medical infrastructure is not some separate, hardened category immune to the same vulnerabilities plaguing retail cold chain management. The EFS got lucky. The monitoring caught it. Next time that may not be the case.