Health ISAC warns industry after cyberattack on French blood bank

Health ISAC, the information sharing and analysis center devoted to the healthcare industry, issued a security bulletin alerting members to a recent wave of cyberattacks targeting refrigeration controllers, including one incident that affected the French Blood Establishment.

The French blood bank incident

The French Blood Establishment confirmed in a press release Tuesday that one of its vendors used in cold storage rooms was targeted by malicious cyber activity, resulting in the defrost and temperature thresholds being raised dangerously high. The French Blood Establishment ultimately managed to detect the suspicious activity in time to rescue blood samples.

"This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety," wrote Errol Weiss, the chief security officer at Health ISAC, in an email to NPR. "When threat actors manipulate operational technology like cold-chain storage and refrigeration units holding donor blood, plasma, or critical therapies, they aren't merely stealing data or locking down administrative files, they are directly endangering the physical resources required to sustain human life."

Government and industry response

On Thursday, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, and the U.S. Department of Agriculture published their own fact sheet about threats to industrial refrigeration and cold chain monitoring systems, tools they identify as critical to multiple industries from healthcare to chemical production, food and agriculture, and transportation.

The FBI Cyber Branch Operations director, Brett Leatherman, said the bureau is tracking bad actors targeting these systems "across critical infrastructure sectors globally, putting inventory and equipment at risk."

"Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors," Leatherman said.

Attribution remains unclear

It remains unclear who is responsible for the global attacks on refrigeration controllers, and whether it's multiple actors or groups.

Iran has been linked to at least one incident in Israel earlier in the spring, though that breach involved a lot more sophistication and malicious activity. Investigators probing the disruptions at U.S. military bases are also considering Iran as the potential culprit.

Meanwhile, two pro-Russian hacking groups, NoName057(16) and Z-Pentest Alliance, belatedly released videos and posted on Telegram claiming responsibility for the attacks across Europe, publishing a sample of alleged hacked credentials that would've allowed them to access equipment including machines made by the Danish company Danfoss and the American company Copeland. Those machines can monitor and control temperature and other functions. The hacking groups have some history of targeting refrigeration controllers and other operational technology. However, it's unclear if the recent wave of attacks on refrigerators and freezers across Europe even required stolen credentials to execute, a factor that has led some cybersecurity experts to be skeptical of their claims.

Tom Hegel, who leads threat intelligence research at cybersecurity firm SentinelOne, said it will require more evidence like access logs, configuration changes, and connections between maintenance accounts on the controllers to make any clear assessments.

"Russian-aligned actors are a credible hypothesis because there is a credible precedent, including the refrigeration-related attack DOJ attributed to CyberArmyofRussia_Reborn and NoName's history of politically motivated disruption. But that is only the context, not the missing evidentiary link to these European incidents," Hegel told NPR.

"It's important to note that such Russian threat actors often seek attention and claim to cause incidents even when false," he continued.

Why it matters

Thousands of refrigeration controllers in France alone were exposed to the open internet with almost no protection before unidentified hackers went after them in October. Afterward, experts were still tracking hundreds of devices left unprotected. That's just a fraction of the tens of thousands of exposed operational devices online, many of them embedded in critical infrastructure.

Health ISAC urges the healthcare industry to separate refrigeration controllers from hospital IT systems, enforce strict network segmentation, and add safeguards that software overrides cannot bypass, such as hard-wired mechanical cutoffs and independent thermal alarms. The alert also urges hospitals to have offline backups of their systems and to train staff onsite on how to take physical manual control of machines in an emergency.

---

Sources

• npr.org: Healthcare industry warned following cyberattack on French blood bank : NPR
• wyso.org: Health intel-sharing group warns industry in wake of cyberattack on French blood bank | WYSO

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.