Authorities are investigating a cyberattack targeting a refrigeration-equipment supplier for the French Blood Establishment [EFS], which oversees France’s civilian blood supply.
An unknown hacker was able to manipulate temperature controls at cold storage rooms for three EFS sites, according to the agency. Temperatures and defrosting thresholds were raised to very high levels.
EFS monitoring systems and alarms detected the activity, and staff were able to regain control. The supplies were transferred to other facilities, the agency said, and the integrity of those blood supplies was not compromised.
The supplies included blood plasma intended for transfusions and plasma used to develop medications through a process called fractionation.
EFS technical teams are coordinating their response with the National Cybersecurity Agency of France (ANSSI) and the Ministry of Health.
The attacks follow a series of similar attacks, in which hackers switched supermarket refrigerators to a superheated defrost cycle, causing millions of dollars in spoiled produce, dairy products and other food.
The first attack took place at hundreds of French supermarkets in October and a second wave of attacks targeted grocery stores across multiple European countries. Similar attacks are being investigated by the U.S. military, after ‘outages’ were reported at more than a half-dozen bases at Army and other commissaries.
French officials confirmed they were investigating the attacks and taking steps to prevent additional hacks in the future.
“Since the mid-October incidents, ANSSI is conducting investigations and ensuring the coordinated implementation of preventive and remediation measures, alongside every industry which might be impacted by this incident,” a spokesperson told Cybersecurity Dive on Thursday.
The agency said it is aware of compromises involving Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb controllers. The agency issued guidance about vulnerabilities in these devices and urged security teams to protect these devices from the open internet. Thousands of devices remain exposed on the internet and are visible to potential attackers.
Researchers at Claroty in August released a report outlining critical flaws in Danfoss controllers that could allow a hacker to execute remote code, enabling manipulation of key functions, including temperature.
In the U.S., the Health Information Sharing and Analysis Center sent an advisory to members warning of the potential risk of attack, said Errol Weiss, the group’s chief security officer.
