Attackers altered blood-storage refrigeration settings at three French sites

Key points

• Unidentified attackers tampered with settings on blood storage refrigeration units.
• Three facilities operated by France’s national blood service were affected.
• Temperature thresholds and defrost cycles were altered.
• No CVE was assigned, so patching alone is not a sufficient response.
• Blood product integrity and supplier remote-access controls are the main concerns.

A cyber intrusion tied to a cooling-equipment supplier allowed unknown parties to change configuration on refrigerators used to preserve blood, affecting three sites run by France’s national blood organization. The attackers adjusted thermal parameters and modified defrost cycles, introducing a risk to blood products kept in those units. No CVE identifier has been associated with the incident, which means the issue is not a straightforward software vulnerability with a published patch.

The affected organization is the French national blood service, and the impacted equipment is specialized refrigeration for blood storage. Because blood components must be held within strict environmental limits, even small changes to temperature settings or defrost behavior can matter. The concern is less about conventional malware on office computers and more about the integrity of environmental controls that protect perishable medical products.

This case highlights a broader exposure in supplier-managed operational technology. Refrigeration controllers and similar devices are often maintained through remote connections, default credentials, or vendor portals that receive less scrutiny than core IT systems. When attackers can alter setpoints, the consequences may not appear immediately; they can emerge through gradual temperature drift or unexpected defrost activity that compromises stored materials.

At this stage, the attackers have not been identified, and there is no confirmed evidence of patient harm or theft of data. The priority is to determine whether other facilities received similar configuration changes and whether supplier access was abused. Organizations should watch for unexplained setpoint edits, unusual vendor logins, and discrepancies between physical readings and controller displays. Blood services and hospital blood banks should also verify that alarm thresholds and escalation paths are working as intended.

What to do now

1. Immediately verify temperature and defrost setpoints on all blood storage refrigeration against validated operating ranges, and lock or document approved configurations.
2. Suspend or tightly restrict supplier remote access to refrigeration controllers until access paths, accounts, and authentication controls are reviewed.
3. Review controller logs, vendor portal activity, and configuration histories across all facilities for unauthorized changes, not only the three known sites.
4. Quarantine or inspect affected blood products according to blood bank procedures, and document any temperature excursions for medical review.
5. Segment refrigeration and other medical-device networks from corporate IT, and monitor for unexpected inbound or outbound connections.
6. Change default or shared credentials on refrigeration equipment, enable multi-factor authentication where supported, and alert on setpoint changes.
7. Preserve evidence, coordinate with the equipment provider and incident-response teams, and notify relevant health-sector authorities as required.

Original source

BleepingComputer