Unknown actors changed cooling settings at three French blood-service locations

En bref

• Unknown attackers changed temperature settings on blood-service refrigeration equipment.
• Three locations in France were affected; the activity is linked to a broader European campaign.
• No CVE identifiers are tied to the incident.
• IT and OT teams should verify storage conditions and review remote access to cooling systems.

An intrusion campaign surfaced during the current week in which unidentified operators modified settings on cooling equipment used by France’s blood establishment. Three facilities in that country are known to have been affected. The target was not conventional IT infrastructure but the refrigeration and temperature-regulation layer that keeps blood products within required ranges.

Because the activity appears tied to a campaign that reaches beyond France, defenders should treat it as a regional probing and access effort rather than a single-site anomaly. No CVE numbers have been published, so patching a named software vulnerability is not the primary lever; organizations should instead examine how cooling controllers are reached, managed, and monitored.

The operational risk is concentrated in storage integrity. If setpoints or alarm thresholds are changed without clinical staff noticing, blood components can move outside validated conditions before anyone detects a drift. Even where no product loss is confirmed, the incident forces manual temperature checks, quarantine decisions, and documentation for compliance.

For K-12 and government IT teams, the lesson is that building-management and lab-support systems often sit on flat networks with vendor remote access. The same pattern—unmanaged devices, shared passwords, and internet-exposed controllers—can appear in school cafeterias, nurse offices, and science labs.

What to watch: repeated login attempts against HVAC or refrigeration controllers, unexpected setpoint changes, disabled alarms, new remote-access accounts, and anomalous outbound connections from OT segments. Confirm whether the European campaign has local indicators and ensure manual temperature verification is part of the incident playbook.

À faire maintenant

1. Immediately verify physical temperatures and product viability with clinical or facilities staff, and document all checks.
2. Isolate affected refrigeration controllers from broad network access; segment OT/HVAC devices from user and administrative networks.
3. Audit controller logs, remote-access accounts, vendor connections, and alarm histories; rotate credentials and enforce MFA where supported.
4. Restore known-good setpoints and alarm thresholds, then compare configurations across all similar sites.
5. Coordinate with the blood service, equipment vendors, and authorities; share indicators and check for the same activity in your region.
6. Add OT-focused monitoring for setpoint changes, alarm suppression, and unusual outbound traffic from cooling systems.
7. Run a tabletop exercise covering manual temperature verification, product quarantine, and communications during a refrigeration-control incident.

Source originale

The Record