[ITmedia News] Cyber attack on refrigeration equipment at French blood center; temperature settings tampered with; damage to blood products avoided

France's public blood service organization, Établissement français du sang (EFS), announced on November 3 (local time) that the contractor that manages its refrigeration facilities was attacked by a cyberattack, resulting in an abnormality in the temperature control systems of the cold storage rooms at three EFS facilities. There was no damage to blood products, etc.

The attack occurred on November 2nd. EFS itself was not directly attacked, but the systems of the contractor that manages the refrigeration facilities were compromised. As a result, the temperature of the refrigerator compartment and the defrost function settings were changed to abnormally high temperatures.

EFS is a public institution in France that is responsible for collecting donated blood and supplying blood products, and its cold rooms store blood products to be supplied to medical institutions and samples for testing.

According to EFS, monitoring and alarm systems quickly detected the anomaly, and the affected equipment was controlled or shut down and the stored products were preemptively moved to other equipment. The targets included plasma for blood transfusions and plasma for pharmaceutical manufacturing, but no loss of blood products or health hazards have been confirmed. Blood donations and the supply of blood products are continuing as usual.

EFS is currently working with the French National Information Systems Security Agency (ANSSI) and the Ministry of Health to strengthen operational status and temperature monitoring of all equipment.

In France, on October 11-12, the refrigeration and freezing equipment of hundreds of major supermarkets was attacked by a cyberattack, causing temperatures to rise up to 50 degrees Celsius and causing large amounts of food to be wasted. Regarding this incident, vulnerabilities in the remote management system for refrigeration equipment and deficiencies in security measures have been pointed out. This time as well, there is a common thread that the temperature and defrost settings of the refrigeration equipment were changed illegally, but it is not clear whether the two incidents are related.