Cyberattack Hits French Blood Service Supplier, Tampers With Cold-Storage Settings
The French Blood Establishment (EFS) confirmed that a cyberattack compromised one of its refrigeration equipment suppliers, resulting in unauthorized changes to cold-room temperature settings used to store blood samples and frozen plasma. Attackers reportedly altered settings from -30°C to 110°C, but EFS's monitoring and alarm systems detected the anomalies in time, allowing affected equipment to be isolated or neutralized and stored products to be preventively relocated to other facilities. No blood products or samples were lost. EFS notified ANSSI (France's cybersecurity agency) and the Ministry of Health, and did not publicly name the compromised supplier.
This incident follows a broader wave of refrigeration-targeting cyberattacks across Europe, where retailers in Belgium, Ireland, Luxembourg, Sweden, Estonia, Finland, Germany, Portugal, Romania and the Netherlands reported remotely triggered defrost cycles causing spoilage, with temperatures reaching 50°C. The UK's NCSC chief confirmed some impact on the UK food supply chain, with meat suppliers reporting affected fridges. A separate wave a month earlier hit French supermarket chains including Carrefour, Coopérative U, Intermarché and Monoprix, and US military commissaries were also affected in August. Some victims identified Danfoss AK-SM/AK-SC controllers in their environments, prompting a CERT-FR advisory urging remediation of vulnerabilities in these systems, though it remains unclear if the EFS incident used the same access route.
Linha do tempo
-
Cyberattack Hits French Blood Service Supplier, Tampers With Cold-Storage Settings
ler a análise desta fonte ocultar
The French Blood Establishment (EFS) confirmed that a cyberattack compromised one of its refrigeration equipment suppliers, resulting in unauthorized changes to cold-room temperature settings used to store blood samples and frozen plasma. Attackers reportedly altered settings from -30°C to 110°C, but EFS's monitoring and alarm systems detected the anomalies in time, allowing affected equipment to be isolated or neutralized and stored products to be preventively relocated to other facilities. No blood products or samples were lost. EFS notified ANSSI (France's cybersecurity agency) and the Ministry of Health, and did not publicly name the compromised supplier.
This incident follows a broader wave of refrigeration-targeting cyberattacks across Europe, where retailers in Belgium, Ireland, Luxembourg, Sweden, Estonia, Finland, Germany, Portugal, Romania and the Netherlands reported remotely triggered defrost cycles causing spoilage, with temperatures reaching 50°C. The UK's NCSC chief confirmed some impact on the UK food supply chain, with meat suppliers reporting affected fridges. A separate wave a month earlier hit French supermarket chains including Carrefour, Coopérative U, Intermarché and Monoprix, and US military commissaries were also affected in August. Some victims identified Danfoss AK-SM/AK-SC controllers in their environments, prompting a CERT-FR advisory urging remediation of vulnerabilities in these systems, though it remains unclear if the EFS incident used the same access route.