Cyber Incident Raises Temperatures at French Blood Bank Cold Rooms
Summary
A cybersecurity incident involving a refrigeration supplier raised temperature and defrost thresholds in some French blood bank cold rooms. A technician intervened, products were moved as a precaution, and EFS reported no impact to products or samples.
Key points
- The French Blood Establishment (EFS) said temperature and defrost thresholds rose to very high levels in some cold rooms storing blood products.
- An on-call technician noticed the rise; equipment was controlled or neutralized, and products were preventively transferred. EFS reported no impact to products or samples.
- Coolworld acknowledged a cybersecurity incident involving remote monitoring software and said the affected component came from a third-party supplier.
- British food suppliers also reported refrigeration-system activity; one wholesaler disconnected units from the internet before the temperature changes took effect.
- Copeland confirmed some XWEB monitoring solutions were affected by a cybersecurity vulnerability and advised customers to keep devices off the public internet and apply current software and firmware.
- Attribution remains uncertain. Researchers cautioned that the incidents may not be one campaign and that Russian-linked infrastructure alone does not establish responsibility.
Article Details
- Victim Organization
- EFS (French Blood Establishment)
- Incident Type
- Cybersecurity incident involving remote monitoring of refrigeration operational technology; temperature and defrosting thresholds in some cold-storage rooms were raised to very high levels.
- Operational Impact
- An on-call technician noticed the temperature rise. Affected equipment was brought under control or neutralized, and products in the cold rooms were preventively transferred to other facilities. EFS said products and samples were not impacted.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Richard HorneU.K. NCSC CEO who warned of an expected rise in cyber incidents and discussed vulnerabilities and weak technology foundations.Thomas RegnierEuropean Commission spokesperson who discussed the supermarket attacks and cautioned against attribution.Tony GoodgerSpokesperson for the Association of Independent Meat Suppliers; commented on the reported refrigeration attacks affecting food-supply-chain members.
Vendors
Coolworldand journalistic publication Le Canard enchainé pointed to the Dutch temperature-control outfit Coolworld. The attack was thwarted by an on-call technician who noticed the temperature rise.Copelandof supermarket attacks on insufficiently secured remote controllers from suppliers including Danfoss and Copeland. Copeland's XWEB monitoring controllers were also reportedly vectors for the British attacks.Danfossfirst wave of supermarket attacks on insufficiently secured remote controllers from suppliers including Danfoss and Copeland. Copeland's XWEB monitoring controllers were also reportedly vectors for the British attacks.
Products
Countries
BelgiumIt happened again a couple days ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks Defrost Freezers atEstoniaagain a couple days ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks Defrost Freezers at EuropeanFinlanda couple days ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks Defrost Freezers at EuropeanFranceThe scope of this latest wave of cyberattacks on European refrigeration facilities is expanding, with the first reports of impact in the British food supply chain, and a near-miss at France's public blood bank.Germanycooling units. It happened again a couple days ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack AttacksIrelanddays ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks Defrost Freezers at European Supermarkets).Luxembourgthis time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks Defrost Freezers at European Supermarkets).Netherlandsaffecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks Defrost Freezers at European Supermarkets).Romaniaunits. It happened again a couple days ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh Hack Attacks DefrostRussiaSentinel Labs said Tuesday that Russia's culpability was "one credible hypothesis," due to the fact that the U.S. Department of Justice previously identified Russia as the likely culprit behind an attack on coolingSwedenin their cooling units. It happened again a couple days ago, this time reportedly affecting stores in Sweden, Germany, Romania, Belgium, Estonia, Finland, Ireland, Luxembourg and the Netherlands (see: Fresh HackUnited KingdomThe ripples of that new attack reached Great Britain, food industry and cybersecurity officials said, although apparently without damage.