Hackers target French blood bank refrigeration

A weekend cyberattack on refrigeration systems at French blood storage facilities attempted to raise temperatures to potentially dangerous levels, authorities disclosed on Wednesday.

Three cold storage sites operated by the French Blood Establishment, or EFS, in the Burgundy-Franche-Comte region of east-central France, were affected after hackers breached systems run by Coolworld, a Dutch refrigeration and remote monitoring provider.

The attack was first reported on Wednesday by Le Canard Enchaine, a French weekly newspaper, which said temperature settings on units storing plasma and blood samples were reprogrammed from around -30 C to 110 C — well above boiling point.

Officials stressed these were target settings entered into the system, not actual temperatures reached inside storage rooms. Workers averted disaster after a night-shift technician spotted the anomaly and moved quickly to transfer or secure affected products.

EFS President Frederic Pacoud said the attack could have resulted in the loss of plasma destined for patients, but a warning system ensured "there was no compromise to the safety of blood products".

No health consequences or product losses were reported, and distribution operations continued uninterrupted, an EFS statement said.

"Monitoring and alarm systems quickly detected the anomalies, allowing employees to take action to ensure that no blood products or samples were compromised," it added.

Authorities have since disabled remote access to the compromised units. The Health Ministry credited monitoring and alarm systems with protecting blood supplies from damage.

On Wednesday, Coolworld acknowledged the incident, saying it had "responded promptly by implementing the appropriate measures". The company attributed the security flaw to third-party software.

"The vulnerability currently being reported in the media concerns a component supplied by a third-party provider and not directly controlled by Coolworld," it said.

Operations across five countries — France, Germany, Ireland, the Netherlands, and the United Kingdom — fall under Coolworld's remit.

Investigators from France's national cybersecurity agency and Health Ministry are probing the breach, but said no suspects have been identified.

Similar intrusions struck refrigeration infrastructure elsewhere across Europe last month. Freezers and refrigerators were compromised at supermarkets and independent stores across France, Belgium, and the Netherlands in mid-October, spoiling large quantities of food.

Ahold Delhaize, the Dutch retail giant hit in that wave, warned Wednesday the damage could cut fourth-quarter sales by up to $281 million and reduce operating income by more than $112 million.

"While most of the disruption was contained within two weeks, work continues to fully restore our normal operations," the retailer's CEO Frans Muller said. In the United States, Pentagon officials are investigating cyberattacks in August that hit food storage coolers at several military bases, destroying an undisclosed amount of supplies.