When the cold gets hacked: lessons from the attack on the French blood bank

The incident: when the thermostat becomes an attack vector

The French Blood Service (EFS) has seen how a cyberattack touched one of the most sensitive assets of its operations: the refrigeration chambers where blood samples and other biological products are stored. According to reports, the incident occurred on a Monday and affected the monitoring and control systems of equipment deployed in three centers. The institution has clarified that the chambers depend on an external provider, so the attack was not directed against the EFS but against that third party's service.

The EFS monitoring systems detected anomalies in temperature and defrost thresholds, which put the viability of stored samples at risk. Early detection allowed the products to be transferred to other healthcare centers before they were lost. The EFS is now working with the French National Cybersecurity Agency (ANSSI) on the investigation and has reinforced the monitoring of the operation and temperature of its chambers.

What exactly did the attacker do

S2GRUPO's analysis suggests that the attackers did not enter the EFS directly: they used the access of the cooling provider, Coolworld. The action remained at a first level of manipulation—raising temperature setpoints—without activating defrost. Alarms went off, products were transferred preventively, and there were no losses. Óscar Navarro, head of Industrial Cybersecurity at S2GRUPO, points out that raising the temperature setpoint is within reach of anyone with access to a panel exposed on the Internet, without needing to know anything about refrigeration. Activating defrost, on the other hand, requires greater knowledge of the industrial process. The conclusion is uncomfortable: in Europe both profiles coexist, and whoever activates defrost is not an opportunist but an actor who understands the process and seeks maximum impact.

The pattern repeats: supermarket refrigerators, HVAC, water

This incident recalls the two recent ones against supermarkets in France and other European countries, which also suffered attacks against their refrigeration chambers with million-euro losses. George Onofrei, CERT analyst at Stoïk, sums it up clearly: when we think of cybersecurity we think of computers and servers, and we forget everything else that is connected. A cooling controller or a warehouse's HVAC system, often managed by an external provider, are also an entry point, and in many cases they still have the factory password.

Rafe Pilling, senior director of Threat Research at Sophos, admits that it cannot be proven whether the attackers had the deliberate intention of attacking a blood bank. When someone gains access to this type of system, it is not always clear what the affected organization does or what the refrigeration equipment protects. And there lies the problem: once interference with cooling infrastructure is allowed, the consequences can go far beyond finding empty shelves in a supermarket. That same technology may be protecting blood, medicines, and other temperature-sensitive materials.

Aras Nazarovas, senior Information Security researcher at Cybernews, broadens the focus: similar risks exist in heating and ventilation systems, water treatment facilities, pharmaceutical warehouses, and industrial machinery. If attackers access them, they can wreak havoc on essential services or damage goods without setting foot in the facilities. And he adds a key nuance: when the same provider manages the equipment of several organizations, compromising just one can put multiple clients at risk at the same time.

What it means for an SME and its IT team

The first reaction of many SMEs will be to think that this is a matter for large healthcare infrastructures. It is not. Any business with a refrigeration chamber, a freezer, a boiler, industrial HVAC, or a remotely monitored tank has an OT (operational technology) flank that rarely appears in the risk inventory. And it almost always comes through a maintenance provider that connects via the Internet.

The attack on the EFS leaves three ideas worth internalizing:

• The provider is part of your attack surface. If your cooling or HVAC company accesses your equipment remotely, that access is as critical as your corporate email. Ask yourself how it authenticates, from where, and with what credentials.
• Factory credentials are an open door. Control panels exposed on the Internet with the original password are a classic. It is not a theoretical problem: it is the scenario described in the incident analysis itself.
• Early detection makes the difference. At the EFS, temperature alarms went off and allowed a timely reaction. Without monitoring, the incident would have been an irreparable material loss.

What we recommend doing from ForgeNEX

You don't need to set up an industrial SOC to reduce this risk. A proportionate approach covers a lot of ground:

1. Inventory connected OT equipment: chambers, HVAC, boilers, pumps, control panels. Include who maintains them and how they are accessed.
2. Review third-party remote access: require individual authentication, two-factor when possible, and activity logging. No shared accounts or generic VPNs.
3. Change default credentials and segment those devices on a separate network from the corporate network and guest WiFi.
4. Set up temperature and status alerts that reach someone with the ability to act, not just a panel no one looks at.
5. Include OT risk in the continuity plan: what we do if we lose the cold chain, who we call, and how we transfer the product.

This case fits with an idea we have been defending in the blog: security is no longer about putting up a firewall, but about understanding business risk. You can reread our analysis on cybersecurity in SMEs: from firewall to business risk and complement it with the vision of data resilience, because in the end the question is not only whether you will be attacked, but how long it will take you to detect it and how much you will lose in the meantime.

The good news is that the attack on the EFS did not cause losses thanks to detection and preventive transfer. The bad news is that the vector—a cooling panel accessible from the Internet through a provider—is present in thousands of companies that do not even consider it part of their cybersecurity. Reviewing it today is cheaper than explaining it tomorrow.

Source: Computerworld. Analysis and adaptation: ForgeNEX.