Hackers target blood refrigeration units in France, no harm to patients

A cyberattack hit, during the night between November 1 and 2, the temperature control systems of three sites of the Établissement français du sang, the French public agency that manages blood supplies. This is reported by AGI and Cybersecurity360. It is a story that this morning’s edition had not yet covered.

According to what was reconstructed by the two sources, the attack targeted an external supplier that manages refrigeration services on behalf of the agency, altering the programmed temperatures of the units: from -30 degrees to 110 degrees.

The Établissement français du sang stated that the incident had no consequences for patients’ health and that no blood products were lost: “there was no impact on health” — Établissement français du sang, French public blood agency.

Blood and plasma supplies depend on a constant cold chain: a sudden alteration in storage temperatures, if not detected in time, can compromise the integrity of blood products. In this case, according to the agency’s statement, the malfunction induced by the attack did not have this outcome.

The episode fits into a broader series of alleged cyber intrusions against the refrigeration systems of some European supermarkets, a matter this edition had already covered this morning in relation to the meeting held at Palazzo Chigi by the Italian government. In that case the attack concerned the food supply chain; here the target was public health infrastructure, the blood and plasma supplies managed by a French state agency.

The fact that the two episodes share the same type of technical target — the temperature control systems of refrigeration units — without there being, based on the material currently available, a common attribution to a single party responsible, leaves open the question of how connected the two cases are to each other or whether they represent separate episodes sharing the same attack surface.

There is, at the moment, no information on any claim of responsibility nor on an attribution to a specific perpetrator. The French agency has only confirmed the absence of concrete damage, while it remains unclear which external supplier was actually compromised and whether the same vulnerability could affect other health infrastructure in Europe.