Health intel-sharing group warns industry in wake of cyberattack on French blood bank

Cyberattacks on grocery stores and food processing plants everywhere from Europe and Israel to U.S. military bases have drawn headlines in recent months, particularly as attacks have resulted in spoiled food, fires, broken machinery, and major business disruptions. Attackers are clearly aware of the vulnerability of these systems and are taking advantage.

However, until news broke that the French blood bank, known as the French Blood Establishment, had also been targeted, there was less public attention focused on the potential consequences of refrigeration controllers failing in other industries, particularly healthcare, where lifesaving implements like blood and vaccines often require finely tuned temperature-controlled environments to remain viable.

"This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety," wrote Errol Weiss, the chief security officer at Health ISAC in an email to NPR. "When threat actors manipulate operational technology like cold-chain storage and refrigeration units holding donor blood, plasma, or critical therapies, they aren't merely stealing data or locking down administrative files, they are directly endangering the physical resources required to sustain human life."

On Thursday, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, and the U.S. Department of Agriculture published their own fact sheet about threats to industrial refrigeration and cold chain monitoring systems, tools they identify as critical to multiple industries from healthcare to chemical production, food and agriculture, and transportation.

The FBI Cyber Branch Operations director, Brett Leatherman, said the bureau is tracking bad actors targeting these systems "across critical infrastructure sectors globally, putting inventory and equipment at risk."

"Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors," Leatherman said.

Iran, Russia and the search for the culprits

The French blood bank confirmed in a press release Tuesday that one of its vendors used in cold storage rooms was targeted by malicious cyber activity, resulting in the defrost and temperature thresholds being raised dangerously high. The French Blood Establishment ultimately managed to detect the suspicious activity in time to rescue blood samples.

It remains unclear who is responsible for the global attacks on refrigeration controllers, and whether it's multiple actors or groups.

Iran has been linked to at least one incident in Israel earlier in the spring, though that breach involved a lot more sophistication and malicious activity. Investigators probing the disruptions at U.S. military bases are also considering Iran as the potential culprit.

Meanwhile, two pro-Russian hacking groups, NoName057(16) and Z-Pentest Alliance, belatedly released videos and posted on Telegram claiming responsibility for the attacks across Europe, publishing a sample of alleged hacked credentials that would've allowed them to access equipment including machines made by the Danish company Danfoss and the American company Copeland. Those machines can monitor and control temperature and other functions. The hacking groups have some history of targeting refrigeration controllers and other operational technology. However, it's unclear if the recent wave of attacks on refrigerators and freezers across Europe even required stolen credentials to execute, a factor that has led some cybersecurity experts to be skeptical of their claims.

Even so, it will require more evidence like access logs, configuration changes, and connections between maintenance accounts on the controllers to make any clear assessments, explained Tom Hegel, who leads threat intelligence research at cybersecurity firm SentinelOne.

"Russian-aligned actors are a credible hypothesis because there is a credible precedent, including the refrigeration-related attack DOJ attributed to CyberArmyofRussia_Reborn and NoName's history of politically motivated disruption. But that is only the context, not the missing evidentiary link to these European incidents," Hegel told NPR.

"It's important to note that such Russian threat actors often seek attention and claim to cause incidents even when false," he continued.

Regardless of who's responsible, the incident highlights how these nearly ubiquitous tools used to remotely manage critical systems are vulnerable to attack in several different ways.

For one, thousands of the refrigeration controllers in France alone were exposed to the open internet with almost no protection put in place before unidentified hackers went after them in October. Afterward, experts were still tracking hundreds of devices left unprotected. That's just a fraction of the tens of thousands of exposed operational devices online, many of them embedded in critical infrastructure.

Additionally, many of the major remote management systems used in refrigerators and freezers have security vulnerabilities. After alerting the companies to the problems, cybersecurity firm Claroty published research on vulnerabilities in multiple major refrigeration controllers, including those made by both the American manufacturer Copeland and by Danfoss.

While some of those vulnerabilities have been discovered and the vendors have designed patches to seal the hole, the problems don't stop there.

Experts warn it's difficult to patch operational technology because doing so often requires shutting systems down. In industries like healthcare, even minutes of downtime create extreme risk for patient safety. And for some aging models, it's impossible to patch, because the vendor is no longer offering updates — and companies can't afford to spring for a new model.

Sometimes, executives don't even know what machines are on their networks.

Additionally, for many companies, vendors that work with them demand remote access to systems like refrigeration controllers to regularly service them. It's often a requirement in the contract companies sign.

"Industrial chillers operate under vendor contracts that mandate persistent remote access," explained Nic Adams, CEO of 0rcus, a U.S. offensive security firm. "These commercial agreements leave national food and medical supplies defenseless against basic credential abuse."

Finally, hackers are now using AI to find these vulnerabilities faster than ever, and AI is also helping them to better understand the complex machines and the processes they control. Bad actors a world away no longer need to understand individual languages or industries, or even the physics involved to disrupt operations. In recent weeks, cyber incident responders tell NPR they're seeing a massive spike in attacks that are at least in part carried out by AI agents.

The good news is that a lot of these attacks, even if they incorporate AI, are not particularly sophisticated, novel, or stealthy.

Weiss of Health ISAC tells NPR there are basic steps the healthcare industry can take to prevent being a victim of these opportunistic attacks.

That process "begins" by "eliminating public internet exposure," wrote Weiss, then "enforcing strict network segmentation" in order to isolate refrigeration systems "from standard enterprise and guest networks" and finally adding on safeguards "that software overrides cannot bypass" like "hard-wired mechanical cutoffs" and "independent thermal alarms."

In the Health ISAC alert, the industry is urged to separate not just refrigeration controllers from hospital IT systems, but also medical gas monitors, for one, and train staff onsite on how to take physical manual control of machines in an emergency.

Finally, the alert urges hospitals to have offline backups of their systems.

Store managers on the frontlines

Sharing intelligence about these kinds of cyberattacks can help other potential victims avoid disaster.

While Estonian grocery stores were targeted in the most recent wave of attacks, many of those store managers were on high alert thanks to warnings issued by Estonia's Information Systems Authority, RIA. "When one Selver store was attacked on 2 November, the attackers managed to change the refrigeration system's temperature setting to +50°C. However, the service provider reacted quickly and prevented significant damage," said Annika Müür, a spokesperson for RIA. "So while we can't say that Estonia managed to prevent the attacks entirely, I think this case is a good example of the importance of monitoring threats internationally, acting on early warnings and working closely with businesses to minimise the impact."

Weiss of Health ISAC also urged companies across sectors that are being targeted by this recent wave of attacks to share information to help others defend themselves.

"The attack highlights why timely, trusted information sharing across borders and sectors is our strongest collective defense," he wrote.

"Rapid intelligence sharing allows hospitals and health facilities globally to recognize emerging attack patterns, verify vendor exposure, and harden critical infrastructure before threat actors can cause physical harm."