Hackers reportedly set French blood bank plasma freezers to 110°C

During the night of November 1 to 2, an on-call technician notices that the temperature in several freezers is rising abnormally. These units store products of the Établissement français du sang (EFS, the French blood establishment) at around −30°C. Their setpoint had just been changed remotely: it was reportedly raised to 110°C, according to Le Canard enchaîné, which broke the story on November 3.

The target was not the EFS itself but Coolworld, one of its refrigeration contractors. The affected facilities are located in particular in Bourgogne-Franche-Comté. The Ministry of Health says the anomalies were detected in time and had no operational consequences. At this stage, no plasma destruction, no compromised transfusion and no consequences for patients have been reported. No theft of donor data has been reported either.

What was in those freezers?

The EFS first spoke of donor samples, kept for health surveillance. It then clarified that frozen plasma intended for transfusion to patients was also affected. This is not a detail: fresh frozen plasma must be kept at −25°C or below, and a prolonged break in the cold chain could make it unusable.

The 110°C figure must be read for what it is: a programmed setpoint, not a measured temperature. Nothing indicates that the plasma bags came close to that value. The EFS reports three affected sites, including the Besançon site according to ICI. The duration of the incident has not been disclosed and the temperatures actually reached remain unclear: an EFS official told ICI that temperatures “rose to 110 or even 150 degrees,” while insisting that the samples had not been damaged. On social media, some posts claim the blood almost boiled: nothing confirms this.

The same hackers as in the supermarkets?

The question comes up naturally. On October 12, hundreds of French supermarkets had their refrigeration systems tampered with remotely (our article). ANSSI (France's national cybersecurity agency) then explained that weak passwords had been enough, and the CERT-FR alert cited in particular Danfoss AK-SM and AK-SC controllers as well as Copeland and Dixell XWEB systems. On November 2, new suspected cyberattacks were reported in nine countries, including Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia.

For now, no public evidence links the attack on Coolworld to that wave. Coolworld says only that the incident affected remote monitoring software for refrigeration systems and that it hit a component supplied by a third-party provider. How the hackers gained access, and who they are, remains unknown. The risk was not unknown, however: on October 21, before the Senate, ANSSI's director general, Vincent Strubel, mentioned refrigeration installations in the healthcare sector. He said the agency had carried out “rapid and intense work with all healthcare stakeholders.”

Healthcare facilities: what to check right now

Here, it was an on-call technician, who noticed the temperature rise in the middle of the night, who made the difference. A remotely controlled freezer is still an IT device. ANSSI's recommendations after the supermarket attack, supplemented here with a few additional habits, also apply to laboratories, pharmacies and hospitals:

• inventory the cooling controllers and supervision interfaces reachable from the Internet, including those managed by a contractor;
• take these interfaces off the Internet and route remote maintenance through a secure access with strong authentication;
• replace default passwords or passwords shared across several sites;
• check that temperature alarms actually alert an on-call person, at night and on weekends;
• ask the refrigeration contractor in writing how it protects its own access to your equipment.

One question remains for the investigation to settle: how many other refrigeration contractors, in healthcare or elsewhere, expose their equipment in the same way? In a statement, the EFS says that “no health impact has been identified and no loss of blood products needs to be reported.” For its part, Coolworld says that “only a limited number of Coolworld units were affected.”