In the early hours of November 2, attackers reportedly attempted to sabotage the refrigeration systems responsible for storing and cooling part of France’s blood supply. It is the latest in a string of attacks on temperature control settings in Europe, coming on the heels of hackers turning supermarket refrigerators into heaters.
This latest wave of attacks on refrigeration systems in France came to light in early November, when the investigative newspaper Le Canard Enchaîné reported on the campaign. Hackers hijacked refrigeration controllers in cold storage rooms run by the French National Blood Service (EFS). The affected sites included facilities in the Burgundy and Franche-Comté region of east-central France.
The rooms hold blood samples used for health monitoring and plasma intended for transfusions. They are normally kept at around -30°C (-22°F), but the cyberattack reportedly increased cold storage rooms to 110°C (230°F).
No patients were harmed and no blood products were damaged, according to public reporting, but the method behind the attack deserves a closer look.
What Happened
Instead of targeting EFS systems directly, attackers reportedly hit a third-party that maintains the refrigeration systems in the affected rooms. Coolworld, a Dutch company that supplies temperature-control equipment for EFS, said the vulnerability was related to a component from a “third-party supplier and was outside Coolworld’s direct control.”
EFS president Frédéric Pacoud told BFMTV the service could have lost samples or plasma meant for patients. But thanks to the EFS’s monitoring and alarm systems, there was “no compromise to the safety of blood products.” So far, nothing suggests the EFS’s own IT systems were affected.
Not an Isolated Incident
The blood bank incident follows a series of attacks on refrigeration control systems across Europe, including an earlier hit on major French supermarket chains that ruined food stock. The method for both attacks is the same: manipulate the operational technology (OT) that keeps things cold, and product damage — to food or blood supplies — follows without attackers ever setting foot on site.
A manipulated thermostat can destroy physical goods in hours. When the goods are plasma meant for transfusions, the stakes go well beyond financial.
The Supply Chain Is the Attack Surface
The weak link in the supply chain sat outside the affected organization in this case. A remote monitoring tool, run by a provider and built on a component from yet another vendor, became a path to critical healthcare infrastructure. That is multiple layers of third-party risk between the attacker and the freezer.
Many healthcare organizations assess their vendors’ security at onboarding and then rarely look again. OT often gets even less scrutiny. A refrigeration controller doesn’t look like a security risk until someone can reach it from the internet. Security teams should ask these questions:
- Which vendors have remote access to your physical systems? Cold chain monitoring, building controls, and medical equipment all count.
- Are those connections exposed to the public internet? Internet-facing controllers are far easier to find and abuse.
- Do you have independent safeguards? Local alarms, redundant temperature sensors, and clear on-call procedures worked here. They should not depend on the same software that was compromised.
- Can you continuously monitor vendor security posture, not just check it once a year? Vendor risk shifts constantly, so ongoing visibility is the best way to spot a problem before it reaches your operations.
Explore how SecurityScorecard’s continuous monitoring can help you spot third-party risk as it’s building, and request a demo today.
