France's blood service EFS says an attack on refrigeration controls at three cold-storage sites was caught by alarms before plasma was damaged, in the latest apparent escalation of fridge attacks across Europe.
France's national blood service, the Établissement français du sang (EFS), said that temperature and defrosting thresholds were raised to "extremely high levels" on Monday at three cold-storage sites holding plasma, according to Euronews and the Guardian. The plasma was intended for transfusions and for the manufacture of medicines. The EFS said its monitoring and alarm systems detected the anomalies quickly, allowing staff to move or secure the products, and that no health consequences had been identified and no blood products were lost. Blood collection and distribution continued without interruption.
The EFS said the attack hit a supplier of refrigeration equipment, and that the cold stores were run by contractors rather than the service itself, meaning it was not directly targeted. France's national cybersecurity agency, ANSSI, and the Health Ministry have been alerted and are investigating, and the service has reinforced monitoring of all its equipment. The EFS collects, tests and distributes blood products to more than 1,900 hospitals in France and supports more than a million patients a year, according to the Guardian.
The incident follows attacks this week on refrigeration controls at supermarkets in nearly a dozen European countries, where fridge and freezer temperatures were reportedly pushed as high as 50C, spoiling food worth millions of euros. The Guardian also reports that hackers seized control of cooling units in as many as 700 French supermarkets last month. No group has claimed responsibility and no motive is known. An EU spokesperson said the incidents are "not isolated" and that EU agencies are discussing a collective response with national authorities, without naming any culprit. Sophos threat-intelligence director Rafe Pilling told the Guardian the most plausible explanations are a state-based demonstration of capability or a lone hacker; neither has been confirmed.
