Cyberattack on the French Blood Establishment: cold rooms pushed to 110°C

Coin Encyclopedia Improve your knowledge of cryptos

An on-call technician saw the temperatures rising and raised the alarm before a single bag was lost. The Ministry of Health assures that the transfusion chain has never been interrupted and that no patient has been exposed.

In these containers sat health surveillance samples and bags intended for transfusions. Fresh frozen plasma can be stored for up to three years at −25°C. Once it goes back above zero, it goes to destruction (remember that a thawed bag can never be refrozen). The tampered deposit would have wiped out the stock in a few hours.

On BFMTV, EFS president Frédéric Pacoud ruled out any attack on product safety.

“We could have lost samples or bags of plasma intended to treat patients. »

The incident is not the first for the establishment. By March 2024, the theft of data from its donor management software had affected around 1.5 million people, with identity information and medical history exposed.

However, the modus operandi was nothing new. During the night of October 11 to 12, hundreds of French supermarkets found their refrigeration units out of order, at Intermarché, E.Leclerc and Coopérative U. The stores threw away some of their fresh and frozen products.

On November 2, the attack gained momentum: Fifteen Carrefour stores were affected in Belgium. Thirteen SuperValu supermarkets have withdrawn products from sale as a precaution in Ireland. Same scenario in Sweden, where brands have emptied their freezers.

These installations are controlled by connected automation systems which allow technicians to monitor temperatures and intervene without having to travel. When the management interface is lying around on the Internet with a factory password, changing a setpoint requires no technical prowess.

The French cybersecurity agency (ANSSI) published an alert on October 12 on the hacking of refrigeration installation controllers, before extending it to several ranges from Danfoss, Copeland and Dixell. Its recommendations can be summarized in a few lines: remove management interfaces from the Internet, lock remote access, apply updates and check settings, starting with the defrost ranges. A defrost cycle legitimately raises the temperature of a cold room, and a tampered with parameter then passes for a routine operation.

However, no one has claimed responsibility for the attack. No ransom demand has filtered through to Coolworld or major retailers, unlike the usual scenario when a healthcare establishment is targeted. The hackers from the South Paris region hospital center of Corbeil-Essonnes had demanded $10 million in August 2022, divided their demand by ten, then published the stolen data for lack of payment.

Machine-translated from French