Authorities are investigating a cyberattack targeting a refrigeration-equipment supplier for the French Blood Establishment (EFS), which oversees France’s civilian blood supply.
An unknown hacker was able to manipulate temperature controls at cold storage rooms for three EFS sites, according to the agency. Temperatures and defrosting thresholds were raised to very high levels.
EFS monitoring systems and alarms detected the activity, and staff were able to regain control. The supplies were transferred to other facilities, the agency said, and the integrity of those blood supplies was not compromised.
The supplies included blood plasma intended for transfusions and plasma used to develop medications through a process called fractionation.
EFS technical teams are coordinating their response with the National Cybersecurity Agency of France (ANSSI) and the Ministry of Health.
The attacks follow a series of similar attacks, in which hackers switched supermarket refrigerators to a superheated defrost cycle, causing millions of dollars in spoiled produce, dairy products and other food.
The first attack took place at hundreds of French supermarkets in October and a second wave of attacks targeted grocery stores across multiple European countries. Similar attacks are being investigated by the U.S. military, after ‘outages’ were reported at more than a half-dozen bases at Army and other commissaries.
French officials confirmed they were investigating the attacks and taking steps to prevent additional hacks in the future.
“Since the mid-October incidents, ANSSI is conducting investigations and ensuring the coordinated implementation of preventive and remediation measures, alongside every industry which might be impacted by this incident,” a spokesperson told Cybersecurity Dive on Thursday.
The agency said it is aware of compromises involving Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb controllers. The agency issued guidance about vulnerabilities in these devices and urged security teams to protect these devices from the open internet. Thousands of devices remain exposed on the internet and are visible to potential attackers.
Researchers at Claroty in August released a report outlining critical flaws in Danfoss controllers that could allow a hacker to execute remote code, enabling manipulation of key functions, including temperature.
In the U.S., the Health Information Sharing and Analysis Center sent an advisory to members warning of the potential risk of attack, said Errol Weiss, the group’s chief security officer.
U.S. authorities, led by the FBI and Cybersecurity and Infrastructure Security Agency, urged security teams to harden their industrial refrigeration and cold-chain monitoring systems, in a fact sheet released Thursday.
Officials warned that hackers could exploit vulnerabilities that would allow them to set devices into continuous heating and defrost cycles. Flaws in these systems could allow a hacker to bypass authentication or inject code, resulting in fires, loss of inventory and potential harm to consumers.
Industry officials have been closely monitoring the situation. Refrigeration and cold storage monitoring systems are used for a range of healthcare applications, including storage of vaccines, medications, blood products and laboratory specimens.
“While there is no indication of any confirmed incidents targeting U.S. hospitals or healthcare organizations through refrigeration systems, these incidents serve as a reminder that internet-connected operational technology and facility=management systems have been targeted in other critical infrastructure sectors,” John Riggi, national advisor for cybersecurity and risk at the American Hospital Association, told Cybersecurity Dive.
Federal authorities offered several mitigation steps for network defenders to secure their systems:
- Replace default passwords with complex passwords and use phishing-resistant multifactor authentication.
- Keep device firmware up to date and replace devices that are no longer supported by manufacturers.
- Isolate industrial systems by creating a dedicated virtual local area network for OT devices.
- Remove devices from the public internet by securing them behind a firewall.
Editor’s note: Updates with information from the FBI, CISA and the American Hospital Association.
