From −30 to 110°C. This is the instruction that pirates imposed on the cold rooms of the French Blood Establishment (EFS). The Chained Duck revealed the hacking of Coolworld, a service provider responsible for the maintenance of these refrigerated containers. The attack dates back to the night of November 1 to 2 and targeted installations located in Burgundy-Franche-Comté.
An on-call technician saw the temperatures rising and raised the alarm before a single bag was lost. The Ministry of Health assures that the transfusion chain has never been interrupted and that no patient has been exposed.
Key Points
Via the service provider Coolworld, hackers changed the EFS refrigerated container deposit from −30°C to 110°C, without loss of pockets thanks to an on-call technician
Three weeks earlier, hundreds of French supermarkets suffered the same disruption, followed by stores in Belgium, Ireland and even Sweden.
ANSSI had warned about refrigeration controllers accessible from the Internet and advised cutting their remote management interfaces
No ransom demanded here, as global ransomware payments fall to $813 million in 2024 according to Chainalysis
Cyberattack on the French Blood and Plasma Establishment at 110°C
In these containers sat health surveillance samples and bags intended for transfusions. Fresh frozen plasma can be stored for up to three years at −25°C. Once it goes back above zero, it goes to destruction (remember that a thawed bag never refreezes). The tampered deposit would have wiped out the stock in a few hours.
On BFMTV, the president of the EFS Frédéric Pacoud ruled out any attack on product safety.
“We could have lost samples or bags of plasma intended to treat patients. »
Frédéric Pacoud, president of the French Blood Establishment
The incident is not the first for the establishment. By March 2024, the theft of data from its donor management software had affected around 1.5 million people, with identity information and medical history exposed.
From French supermarkets to Swedish fridges, the cold chain under attack
However, the modus operandi was nothing new. During the night of October 11 to 12, hundreds of French supermarkets found their refrigeration units out of order, at Intermarché, E.Leclerc and Coopérative U. The stores threw away some of their fresh and frozen products.
On November 2, the attack gained momentum: Fifteen Carrefour stores were affected in Belgium. Thirteen SuperValu supermarkets have withdrawn products from sale as a precaution in Ireland. Same scenario in Sweden, where brands have emptied their freezers.
These installations are controlled by connected automation systems which allow technicians to monitor temperatures and intervene without having to travel. When the management interface is lying around on the Internet with a factory password, changing a setpoint requires no technical prowess.
The French cybersecurity agency (ANSSI) published an alert on October 12 on the hacking of refrigeration installation controllers, before extending it to several ranges from Danfoss, Copeland and Dixell. Its recommendations can be summarized in a few lines: remove management interfaces from the Internet, lock remote access, apply updates and check settings, starting with the defrost ranges. A defrost cycle legitimately raises the temperature of a cold room, and a tampered with parameter then passes for a routine operation.
Other times, other customs
However, no one has claimed responsibility for the attack. No ransom demand has filtered through to Coolworld or major retailers, unlike the usual scenario when a health establishment is targeted. The hackers from the South Paris region hospital center of Corbeil-Essonnes had demanded $10 million in August 2022, divided their demand by ten, then published the stolen data for lack of payment.
Is fashion passing? Ransom payments have been declining for two years. Chainalysis estimated them at $813 million in 2024, or 35% less than in 2023, a record year of $1.25 billion. The proportion of victims who agree to pay has fallen below 30% according to Coveware, which follows these negotiations quarter after quarter.
Payment traceability has something to do with it. A ransom paid in bitcoin leaves a public and definitive trace in the register, which investigators trace from address to address to the exchange platforms. We will remember the emblematic case where the FBI recovered 63.7 of the 75 bitcoins paid by Colonial Pipeline, one month after the attack in May 2021. Sabotage without payment leaves nothing comparable and investigators are reduced to analyzing much smaller traces. like connection logs.
No formal link has been established between the Coolworld hack and the October wave, and nothing says whether the targeted cold rooms contained the equipment listed by the agency. The on-call service returned the containers to their deposit before the slightest loss. The EFS needs 10,000 donations per day to maintain its stocks. Consider donating!
