Health ISAC warns medical facilities after attack on French blood bank — NPR
In France, Health ISAC, an organization that shares cyberthreat intelligence in the healthcare sector, warned its members about a wave of attacks on refrigeration equipment controllers. One of those affected was the French Blood Service: malicious activity targeted a supplier of systems for refrigerated facilities. As NPR reports, the institution detected suspicious activity in time and preserved the blood samples.
The French Blood Service said that during the incident, defrosting settings and temperature thresholds were raised to dangerous levels. Health ISAC stressed that interference with refrigeration systems storing donated blood, plasma, or critically important medicines could directly endanger resources needed to save lives.
Vulnerable cooling systems
Industrial cooling controllers are used in medicine, the food industry, agriculture, transport, and chemical manufacturing. The U.S. Federal Bureau of Investigation is tracking malicious actors who attack such systems at critical infrastructure facilities in various countries. According to the agency, stocks of goods and equipment are at risk.
Before the attacks in France, thousands of refrigeration equipment controllers were accessible from the open internet with virtually no protection. After the incidents, specialists still identified hundreds of unsecured devices. Claroty also reported vulnerabilities in controllers, including equipment made by the U.S. company Copeland and Denmark's Danfoss.
More current news is available on the UA.News Telegram channel Telegram.
Updating the software of such systems often requires shutting them down, which is particularly risky for hospitals. Some outdated equipment no longer receives updates from manufacturers, while suppliers often require постоянный remote access to controllers for maintenance.
Versions regarding those involved
Those responsible for the series of attacks on refrigeration controllers have not yet been identified. Iran was linked to at least one incident in Israel, and investigators are also considering this possibility regarding disruptions at U.S. military bases. Pro-Russian groups NoName057(16) and Z-Pentest Alliance claimed responsibility for attacks in Europe on Telegram and published a sample of allegedly stolen credentials.
At the same time, experts note that access logs, data on configuration changes, and information about maintenance accounts are needed to draw conclusions. Health ISAC advises healthcare institutions to remove access to such systems from the public internet, isolate refrigeration equipment from primary and guest networks, install independent temperature alarms and mechanical limiters. The organization also recommends training staff to operate equipment manually and keeping offline backups of systems.
