Health intel-sharing group warns industry in wake of cyberattack on French blood bank
asserted
group → share → bank
In a new security bulletin, the information sharing and analysis center devoted to the healthcare industry, Health ISAC, alerted members to a recent wave of cyberattacks targeting refrigeration controllers — including one incident that affected a major French blood bank.
asserted
that → devote → bank
"This alert is issued for situational awareness, highlighting how recent operational technology (OT) attacks against specific refrigeration brands directly intersect with emerging threats to the health sector," reads the bulletin seen by NPR.
asserted
bulletin → issue → NPR
Operational technology refers to the machines that control physical processes in the real world, from cooling systems to water pumps.
asserted
that → refer → pumps
Cyberattacks on grocery stores and food processing plants everywhere from Europe and Israel to U.S. military bases have drawn headlines in recent months, particularly as attacks have resulted in spoiled food, fires, broken machinery, and major business disruptions.
asserted
attacks → process → food
Attackers are clearly aware of the vulnerability of these systems and are taking advantage.
asserted
Attackers → take → advantage
However, until news broke that the French blood bank, known as the French Blood Establishment, had also been targeted, there was less public attention focused on the potential consequences of refrigeration controllers failing in other industries, particularly healthcare, where lifesaving implements like blood and vaccines often require finely tuned temperature-controlled environments to remain viable.
asserted
implements → break → environments
"This incident underscores a stark operational reality: cybersecurity in healthcare is fundamentally about patient safety," wrote Errol Weiss, the chief security officer at Health ISAC in an email to NPR.
asserted
Weiss → underscore → NPR
"When threat actors manipulate operational technology like cold-chain storage and refrigeration units holding donor blood, plasma, or critical therapies, they aren't merely stealing data or locking down administrative files, they are directly endangering the physical resources required to sustain human life."
asserted
they → manipulate → life
On Thursday, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services, and the U.S. Department of Agriculture published their own fact sheet about threats to industrial refrigeration and cold chain monitoring systems, tools they identify as critical to multiple industries from healthcare to chemical production, food and agriculture, and transportation.
asserted
they → publish → production
The FBI Cyber Branch Operations director, Brett Leatherman, said the bureau is tracking bad actors targeting these systems "across critical infrastructure sectors globally, putting inventory and equipment at risk."
"Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors," Leatherman said.
asserted
Leatherman → say → actors
The French blood bank confirmed in a press release Tuesday that one of its vendors used in cold storage rooms was targeted by malicious cyber activity, resulting in the defrost and temperature thresholds being raised dangerously high.
asserted
thresholds → confirm → activity
The French Blood Establishment ultimately managed to detect the suspicious activity in time to rescue blood samples.
asserted
Establishment → manage → samples
It remains unclear who is responsible for the global attacks on refrigeration controllers, and whether it's multiple actors or groups.
uncertain
it → remain → controllers
Iran has been linked to at least one incident in Israel earlier in the spring, though that breach involved a lot more sophistication and malicious activity.
asserted
breach → link → sophistication
Investigators probing the disruptions at U.S. military bases are also considering Iran as the potential culprit.
asserted
Investigators → probe → culprit
Meanwhile, two pro-Russian hacking groups, NoName057(16) and Z-Pentest Alliance, belatedly released videos and posted on Telegram claiming responsibility for the attacks across Europe, publishing a sample of alleged hacked credentials that would've allowed them to access equipment including machines made by the Danish company Danfoss and the American company Copeland.
asserted
them → release → company
Those machines can monitor and control temperature and other functions.
asserted
machines → monitor → temperature
The hacking groups have some history of targeting refrigeration controllers and other operational technology.
asserted
groups → have → controllers
However, it's unclear if the recent wave of attacks on refrigerators and freezers across Europe even required stolen credentials to execute, a factor that has led some cybersecurity experts to be skeptical of their claims.
uncertain
that → require → claims
Even so, it will require more evidence like access logs, configuration changes, and connections between maintenance accounts on the controllers to make any clear assessments, explained Tom Hegel, who leads threat intelligence research at cybersecurity firm SentinelOne.
asserted
who → require → SentinelOne
"Russian-aligned actors are a credible hypothesis because there is a credible precedent, including the refrigeration-related attack DOJ attributed to CyberArmyofRussia_Reborn and NoName's history of politically motivated disruption.
asserted
DOJ → align → disruption
But that is only the context, not the missing evidentiary link to these European incidents," Hegel told NPR.
asserted
Hegel → tell → NPR
"It's important to note that such Russian threat actors often seek attention and claim to cause incidents even when false," he continued.
uncertain
he → note → incidents
Regardless of who's responsible, the incident highlights how these nearly ubiquitous tools used to remotely manage critical systems are vulnerable to attack in several different ways.
asserted
tools → highlight → ways
For one, thousands of the refrigeration controllers in France alone were exposed to the open internet with almost no protection put in place before unidentified hackers went after them in October.
asserted
hackers → expose → October
Afterward, experts were still tracking hundreds of devices left unprotected.
asserted
experts → track → devices
That's just a fraction of the tens of thousands of exposed operational devices online, many of them embedded in critical infrastructure.
asserted
That → expose → infrastructure
Additionally, many of the major remote management systems used in refrigerators and freezers have security vulnerabilities.
asserted
many → use → vulnerabilities
After alerting the companies to the problems, cybersecurity firm Claroty published research on vulnerabilities in multiple major refrigeration controllers, including those made by both the American manufacturer Copeland and by Danfoss.
asserted
Claroty → alert → Danfoss
While some of those vulnerabilities have been discovered and the vendors have designed patches to seal the hole, the problems don't stop there.
asserted
problems → discover → hole
Experts warn it's difficult to patch operational technology because doing so often requires shutting systems down.
asserted
doing → warn → systems
In industries like healthcare, even minutes of downtime create extreme risk for patient safety.
asserted
minutes → create → safety
And for some aging models, it's impossible to patch, because the vendor is no longer offering updates — and companies can't afford to spring for a new model.
asserted
companies → age → model
Sometimes, executives don't even know what machines are on their networks.
asserted
machines → know → networks
Additionally, for many companies, vendors that work with them demand remote access to systems like refrigeration controllers to regularly service them.
asserted
that → work → them
It's often a requirement in the contract companies sign.
asserted
companies → sign → contract
"Industrial chillers operate under vendor contracts that mandate persistent remote access," explained Nic Adams, CEO of 0rcus, a U.S. offensive security firm.
asserted
Adams → operate → 0rcus
"These commercial agreements leave national food and medical supplies defenseless against basic credential abuse.
asserted
agreements → leave → abuse
Finally, hackers are now using AI to find these vulnerabilities faster than ever, and AI is also helping them to better understand the complex machines and the processes they control.
asserted
they → use → machines
…and 15 more, not listed.
The Aporia
