French blood bank says it rescued samples after cold-storage breach
Health ISAC, the information sharing and analysis center devoted to the healthcare industry, alerted its members to a recent wave of cyberattacks targeting refrigeration controllers — including one incident that affected a major French blood bank — according to a bulletin seen by NPR.
“This alert is issued for situational awareness, highlighting how recent operational technology (OT) attacks against specific refrigeration brands directly intersect with emerging threats to the health sector,” the bulletin reads. Operational technology refers to the machines that control physical processes in the real world, from cooling systems to water pumps.
Cyberattacks on grocery stores and food processing plants everywhere from Europe and Israel to U.S. military bases have drawn headlines in recent months, particularly as attacks have resulted in spoiled food, fires, broken machinery, and major business disruptions. Attackers are clearly aware of the vulnerability of these systems and are taking advantage of it.
Until news broke that the French blood bank, known as the French Blood Establishment, had also been targeted, there was less public attention focused on the potential consequences of refrigeration controllers failing in other industries, particularly healthcare, where lifesaving implements like blood and vaccines often require finely tuned temperature-controlled environments to remain viable.
“This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety,” Errol Weiss, the chief security officer at Health ISAC, wrote in an email to NPR. “When threat actors manipulate operational technology like cold-chain storage and refrigeration units holding donor blood, plasma, or critical therapies, they aren’t merely stealing data or locking down administrative files, they are directly endangering the physical resources required to sustain human life.”
On Thursday, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, and the U.S. Department of Agriculture published their own fact sheet about threats to industrial refrigeration and cold chain monitoring systems, tools they identify as critical to multiple industries from healthcare to chemical production, food and agriculture, and transportation.
Brett Leatherman, director of the FBI Cyber Branch Operations, said the bureau is tracking bad actors targeting these systems “across critical infrastructure sectors globally, putting inventory and equipment at risk.”
“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” Leatherman said.
The French Blood Establishment confirmed in a press release Tuesday that one of its vendors used in cold storage rooms was targeted by malicious cyber activity, resulting in the defrost and temperature thresholds being raised dangerously high. The organization ultimately managed to detect the suspicious activity in time to rescue blood samples.
It remains unclear who is responsible for the global attacks on refrigeration controllers, and whether multiple actors or groups are behind them. Iran has been linked to at least one incident in Israel earlier in the spring, though that breach involved a lot more sophistication and malicious activity. Investigators probing the disruptions at U.S. military bases are also considering Iran as a potential culprit.
Two pro-Russian hacking groups, NoName057(16) and Z-Pentest Alliance, belatedly released videos and posted on Telegram claiming responsibility for the attacks across Europe, publishing a sample of alleged hacked credentials that they said would have allowed them to access equipment including machines made by the Danish company Danfoss and the American company Copeland. Those machines can monitor and control temperature and other functions. The groups have some history of targeting refrigeration controllers and other operational technology, but it is unclear whether the recent wave of attacks on refrigerators and freezers across Europe even required stolen credentials — a factor that has led some cybersecurity experts to be skeptical of the claims.
Tom Hegel, who leads threat intelligence research at cybersecurity firm SentinelOne, said establishing responsibility would require more evidence such as access logs, configuration changes, and connections between maintenance accounts on the controllers.
“Russian-aligned actors are a credible hypothesis because there is a credible precedent, including the refrigeration-related attack DOJ attributed to CyberArmyofRussia_Reborn and NoName’s history of politically motivated disruption. But that is only the context, not the missing evidentiary link to these European incidents,” Hegel told NPR. “It’s important to note that such Russian threat actors often seek attention and claim to cause incidents even when false.”
Regardless of who is responsible, the incidents highlight how these nearly ubiquitous tools used to remotely manage critical systems are vulnerable to attack in several different ways. Thousands of the refrigeration controllers in France alone were exposed to the open internet with almost no protection in place before unidentified hackers went after them in October, and afterward experts were still tracking hundreds of devices left unprotected. That is a fraction of the tens of thousands of exposed operational devices online, many of them embedded in critical infrastructure.
Additionally, many of the major remote management systems used in refrigerators and freezers have security vulnerabilities. After alerting the companies to the problems, the cybersecurity firm Claroty published research on vulnerabilities in multiple major refrigeration controllers, including those made by both the American manufacturer Copeland and by Danfoss.
Some of those vulnerabilities have been discovered and the vendors have designed patches, but experts warn it is difficult to patch operational technology because doing so often requires shutting systems down. In industries like healthcare, even minutes of downtime create extreme risk for patient safety. For some aging models, patching is impossible because the vendor is no longer offering updates — and companies cannot afford to buy a new model. Sometimes, executives do not even know what machines are on their networks.
Vendor contracts add another exposure. For many companies, vendors that work with them demand remote access to systems like refrigeration controllers so they can regularly service the equipment — a requirement that is often written into the contracts those companies sign.
“Industrial chillers operate under vendor contracts that mandate persistent remote access,” said Nic Adams, CEO of 0rcus, a U.S. offensive security firm. “These commercial agreements leave national food and medical supplies defenseless against basic credential abuse.”
Hackers are also using AI to find these vulnerabilities faster than ever and to better understand the complex machines and the processes they control. Bad actors a world away no longer need to understand individual languages or industries, or even the physics involved, to disrupt operations. In recent weeks, cyber incident responders have told NPR they are seeing a massive spike in attacks that are at least in part carried out by AI agents. The good news, by those accounts, is that many of these attacks, even when they incorporate AI, are not particularly sophisticated, novel, or stealthy.
Weiss said there are basic steps the healthcare industry can take to avoid falling victim to these opportunistic attacks. That process “begins” by “eliminating public internet exposure,” then “enforcing strict network segmentation” to isolate refrigeration systems “from standard enterprise and guest networks,” and finally adding safeguards “that software overrides cannot bypass,” such as “hard-wired mechanical cutoffs” and “independent thermal alarms.”
The Health ISAC alert urges the industry to separate refrigeration controllers from hospital IT systems — along with medical gas monitors, for one — and to train staff onsite on how to take physical manual control of machines in an emergency. It also urges hospitals to keep offline backups of their systems.
Sharing intelligence about these kinds of cyberattacks can help other potential victims avoid disaster. Estonian grocery stores were hit in the most recent wave, and many store managers were on high alert because of warnings issued by Estonia’s Information Systems Authority, RIA.
“When one Selver store was attacked on 2 November, the attackers managed to change the refrigeration system’s temperature setting to +50°C. However, the service provider reacted quickly and prevented significant damage,” Annika Müür, a spokesperson for RIA, said. “So while we can’t say that Estonia managed to prevent the attacks entirely, I think this case is a good example of the importance of monitoring threats internationally, acting on early warnings and working closely with businesses to minimise the impact.”
Weiss urged companies across sectors that are being targeted by this wave to share information so others can defend themselves.
“The attack highlights why timely, trusted information sharing across borders and sectors is our strongest collective defense,” he wrote. “Rapid intelligence sharing allows hospitals and health facilities globally to recognize emerging attack patterns, verify vendor exposure, and harden critical infrastructure before threat actors can cause physical harm.”