From supermarkets to cold storage rooms that store donors' blood: the perimeter of cyber attacks that have hit various European countries is expanding. In France, hackers tampered with the temperature of the systems containing the plasma and blood bags in three regional offices, bringing it from -30 to 110 degrees. No health repercussions, assures the Paris Ministry of Health.
The alarm also resonates in Italy, where the National Blood Center has invited transfusion facilities "to maintain maximum attention, checking temperatures and adapting safety measures to prevent emerging risks". While the National Cybersecurity Agency has addressed a new, pressing recommendation "to all public and private entities that use technologies for maintaining the cold chain, as well as remote control and industrial supervision systems, to adopt with the utmost urgency the verification and mitigation measures already recommended".
Meanwhile, a claim for the recent attack campaign has appeared on the dark web. It was signed by the pro-Russian groups Noname057(16) and Z-Pentest, who also threaten to attack "aqueducts, power plants, industrial plants and food storage sites". But skepticism prevails among those who investigate regarding the reliability of the claim, which contains elements available from open sources. Although Noname and Z-Pentest are among the most active crews in pro-Kremlin propaganda and the Z-Pentest Alliance - linked to GRU, Moscow's military intelligence - has in the past hit infrastructure in various Western countries.
Last Monday, a cyber attack affected Coolworld, a provider of refrigeration services for the French National Blood Institute (EFS). The latter said that "the safety of the stocks has been preserved thanks to the monitoring and alarm systems of the facilities, as well as the precautionary measures immediately implemented", adding that "the monitoring of the operation and temperatures of all our equipment has been strengthened". Similar measures have been ordered by Italy, where the healthcare sector is one of the most targeted by cybercriminals.
The cold chain, explained Luciana Teofili, director of the National Blood Centre, "has always been a particularly controlled aspect", what happened in France "however requires raising the level of attention on the 'cold spaces' of the blood system". But the National Cybersecurity Agency is also moving, after the alerts of the last few days. Today the director Andrea Quacivi was heard by Copasir, who had heard the director of Aisi Bruno Valensise on Tuesday. The point is that - beyond the difficulties of attributing attacks - hostile cyber campaigns are increasingly massive and come from different entities, among which there are also "state actors" such as Russia, China, North Korea, Iran. Which aim to convey the idea of an unprepared and vulnerable West.
And often these are not particularly sophisticated operations, but intrusions that exploit serious negligence on the part of those who should adequately protect their systems. The attackers thus obtain great media coverage with little effort. Hence the new "urgent invitation" issued in the evening by the Agency: the compromise of the cold chain equipment can in fact "determine the interruption of refrigeration processes, the deterioration of stored products and materials up to the unavailability of services with possible repercussions on operational continuity and people's health".
But if in recent days it has been the turn of refrigerators, tomorrow the sector involved could be another. The recall therefore "concerns, more generally, all connected devices and the related administration and monitoring interfaces used to support industrial processes, including supervisory control and data acquisition systems, air conditioning systems, water networks, energy production systems, video surveillance equipment and other technological infrastructures".
