French blood service hit by Europe-wide cyberattacks on refrigeration

Temperature controls were altered at three of France’s national blood service sites this week amid a wave of cyberattacks affecting refrigeration systems across Europe.

The Établissement Français du Sang (EFS) said in a statement Tuesday that “no health impacts have been identified and no losses of blood products have been reported.”

EFS said “temperature and defrosting thresholds were raised to very high levels” at its cold storage rooms, where blood products are kept at preparation and distribution sites before being delivered to healthcare facilities, alongside samples for biobanks.

A spokesperson told Recorded Future News that three sites were affected but was unable to identify the specific one or answer questions about the manufacturer or model of the control systems.

“The EFS's monitoring and alarm systems enabled the rapid identification of these anomalies and the implementation of necessary measures to ensure that no blood samples or products were compromised,” the organization said.

“Thus, depending on the circumstances, as soon as the incident occurred, the affected equipment was either brought under control without impacting the products and samples, or neutralized; the products stored in these cold rooms were preventively transferred to other facilities.”

The EFS says it was not targeted directly. Like many of the similarly affected retailers, it describes the attack as reaching it through a third-party provider of refrigeration equipment.

It is the first reported case in France in the second such wave of attacks targeting control systems, and the first reported to affect a healthcare organisation.

In total, businesses in at least 11 countries have reportedly been affected in the most recent attacks: Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom.

It follows a first wave affecting France in October — with the still unidentified perpetrators remotely defrosting fridges and causing food stock to spoil. It is not clear whether the same perpetrators were behind the most recent attacks, and no group or entity has claimed responsibility.

Following confirmation on Tuesday that British companies were also affected, U.K. authorities said they have not attributed the incidents to any group. A spokesperson for Belgium’s cybersecurity agency told Recorded Future News “it may never be possible to identify” who was behind them.