Cyberattack hits French blood bank site but no blood products are compromised

A cyberattack on several blood banks tried to raise temperatures to extremely high levels but was thwarted before it could do any damage to blood products or samples, French authorities said.

The incident comes after supermarkets in a number of European countries reported this week that their fridges and freezers warmed up after they were remotely taken over, resulting in tons of spoiled food at a total cost of millions of dollars (euros).

The French Blood Establishment, or EFS, said “temperature and defrosting thresholds were raised to extremely high levels” on Monday at three of its cold-storage sites for plasma, in a statement released late Tuesday. Monitoring systems quickly detected the problem, allowing staff to take action in time so that "no blood products or samples were compromised,” it said.

French weekly newspaper Le Canard Enchaîné, which first reported the cyberattack, said that the attack had attempted to reset temperatures that normally are at minus 30 Celsius (minus 22 Fahrenheit) to as high as 110 C (230 F).

The cyberattack hit a supplier of refrigeration equipment at three EFS sites. The products stored were bags of plasma intended for transfusions and plasma used to manufacture medicines, and were either transferred or secured, the EFS statement said.

“No health consequences have been identified, and no blood products were lost,” the blood bank said.

The EFS said blood collection and distribution operations remain uninterrupted, ensuring continued services for patients at hospitals and other healthcare.

The company supplying the refrigeration equipment, Coolworld, said in a statement it “is aware” of the cybersecurity incident.

“The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld’s direct control,” the statement said. The company said only a limited number of units were affected and it was taking “appropriate measures.”

France’s national cybersecurity agency and the Health Ministry are investigating the incident.

This week’s cyberattacks on refrigeration systems mirrored an episode in mid-October that targeted fridges and freezers at hundreds of supermarkets and independent stores across France, Belgium and the Netherlands.

One of the chains hit in that earlier incident, Dutch supermarket chain Ahold Delhaize, said Wednesday that it expected the cyberattack to reduce its sales in the fourth quarter by as much as 250 million euros ($281 million), and crimp its operating income for the period by up to 100 million euros.

“While most of the disruption was contained within two weeks, work continues to fully restore our normal operations,” CEO Franz Muller said. “As we all recognize, cyber threats are an increasingly harsh reality of doing business today,” he said in a statement released with Delhaize’s quarterly earnings.

The company had earlier blamed “malicious actions by others” and proactively took some of its systems offline, including websites and apps for its various brands in Europe as well as in the United States.

——--

AP journalist Kelvin Chan in London contributed to the story