A healthcare information-sharing group has warned hospitals and clinics after a cyberattack on refrigeration controllers at a major French blood bank, NPR reported. In a security bulletin seen by NPR, Health ISAC said recent operational-technology attacks against specific refrigeration brands now intersect with threats to the health sector. Operational technology is the equipment that controls physical processes, including cooling systems.
The French Blood Establishment confirmed in a press release Tuesday that a vendor used in its cold-storage rooms was targeted by malicious cyber activity. Defrost and temperature thresholds were raised dangerously high, the blood bank said. It detected the suspicious activity in time and rescued the blood samples. "This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety," Errol Weiss, Health ISAC's chief security officer, wrote to NPR. When attackers manipulate cold-chain storage holding donor blood, plasma, or critical therapies, he said, "they are directly endangering the physical resources required to sustain human life."
On Thursday, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, and the Department of Agriculture issued their own fact sheet on threats to industrial refrigeration and cold-chain monitoring systems. Brett Leatherman, the FBI Cyber Branch Operations director, said the bureau is tracking actors targeting those systems "across critical infrastructure sectors globally, putting inventory and equipment at risk." Industrial refrigeration protects food, medicine, and other temperature-sensitive products, he said, which makes the systems attractive targets.
It remains unclear who is responsible, and whether one group or several are involved, NPR said. Iran has been linked to at least one incident in Israel earlier in the spring. Investigators looking at disruptions at U.S. military bases are also considering Iran as a possible culprit. Two pro-Russian hacking groups, NoName057(16) and Z-Pentest Alliance, later claimed responsibility for attacks across Europe and posted a sample of alleged credentials for equipment made by Denmark's Danfoss and the American company Copeland. Some cybersecurity experts are skeptical of those claims, NPR reported, because it is unclear whether the recent wave even required stolen credentials. The verified facts for hospitals are narrower: a blood bank's refrigerators were altered, the samples were saved, and U.S. agencies are telling operators of medical cold storage to treat the controllers as a patient-safety risk, not only an IT problem.
Grocery stores, food plants, and even some U.S. military bases have already seen refrigeration-controller attacks that spoiled food, started fires, or stopped work, NPR said. Until the French blood-bank case became public, there was less attention on what a similar failure would mean in health care, where blood and vaccines need tightly controlled temperatures to stay usable. The alert is about that gap: the same class of industrial controllers now sits on the patient-safety side of the ledger.