French blood service says hackers raise temperatures at three cold stores

EFS says temperature and defrosting thresholds were very high; alarms enabled intervention

The EFS said hackers accessed control systems at three cold stores run by its contractors and boosted temperatures at the sites stocking vital blood products. The EFS said the temperature and defrosting thresholds at the three affected cold stores had been raised to “very high levels” in the attack. The French public blood service said alarm systems had allowed technicians to intervene before the products were compromised. The attacks occurred overnight on Monday.

The EFS is France’s public blood-transfusion operator. It collects, tests, prepares and distributes products including blood, plasma and platelets to more than 1,900 hospitals around the country and supports more than a million patients a year. The affected rooms contained plasma bags for transfusions and material used in medicine manufacturing, and products stored there had been moved to other sites.

The attack came amid refrigeration disruptions across almost a dozen European countries. Supermarket refrigerators and freezers reached temperatures as high as 50C (122F), causing millions of euros in food damage. Retailers in Italy, Germany, Romania and the UK were targeted on Tuesday, after problems were reported the previous day in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden.

In a wave of attacks last month, hackers seized control of cooling units in as many as 700 supermarkets in France. A regional branch of Crédit Mutuel also said on Wednesday that it had been the victim of a cyberattack.

Something similar to the European refrigeration disruptions may have happened in the United States, where a series of mysterious refrigerator malfunctions hit commissaries at at least six military bases in early August. The Pentagon was investigating a suspected hack.

Italy’s government held emergency talks with intelligence officials on Tuesday. Thomas Regnier, an EU spokesperson, said the bloc’s agencies were holding urgent discussions with national authorities to formulate a collective response. “These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents,” he said, declining to name potential culprits.

No motive for the attacks was known and no one had claimed responsibility. Some authorities and experts fear government-sponsored hybrid attacks in the aftermath of Russia’s 2022 invasion of Ukraine, while Western intelligence officials say Moscow is waging a campaign of sabotage across Europe that is taking many forms. The French cold-store attack remained unattributed.

Rafe Pilling, the senior director for threat intelligence at Sophos, told The Guardian this week that the most plausible attribution scenarios were a “state-based signalling and demonstration of capability” or a lone-wolf hacker.

The report noted that a growing range of devices, including commercial refrigeration systems, can be monitored and controlled remotely. It said internet-connected software can leave code open to hackers when emerging vulnerabilities are not patched.

The EFS said it was not directly targeted; the attacks hit cold stores run by its contractors. Products stored in the affected rooms, which included plasma bags for transfusions and medicine manufacturing, had been moved to other sites. It alerted France’s national cybersecurity agency, ANSSI, and the health ministry, and it said monitoring of all its equipment had been reinforced.