Three French blood-storage sites were hit by a refrigeration attack earlier this week. Hackers had changed temperature settings on equipment holding plasma and other supplies. Staff responded to alarms and moved blood into refrigerators that weren't connected. Nothing was lost, the blood service said.
That's a relief, particularly after the supermarket attacks RedState has been covering. Employees at those stores were left throwing out spoiled food. The French blood service had supplies intended for patients to protect.
Outside providers operated the affected cold-storage units, according to Établissement Français du Sang (EFS), or in English, the French Blood Establishment. Someone had gone in and changed the settings: “Specifically, temperature and defrost thresholds were set to excessively high levels.”
The statement also explained what those units hold:
These cold storage units—located at EFS preparation and distribution sites—are used to store blood products prior to their delivery to healthcare facilities, as well as samples intended for EFS biobanks.
That included frozen plasma for transfusions and manufacturing medicines. EFS said its alarms sounded quickly. Staff got some units back under control and shut others down. Samples were moved to other facilities, while blood collection and distribution continued.
EFS spokesperson Charley Dubois told Reuters:
“We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected.”
Coolworld maintains the refrigeration controls. Its statement said the company took “appropriate measures,” without identifying them. Customers with the equipment still running could use something more specific.
The vulnerability, Coolworld says, came from another supplier's parts and was beyond its direct control, but it still only affected a limited number of fridges. That's great, fair enough, but which fridges? Which part? Customers need to be able to check the fridges and parts in front of them and find out what needs to be fixed.
For the affected French refrigerators, remote access is now off, according to the health ministry. Investigators are working out how the attackers entered and when the systems can return to service safely.
At home, the Federal Trade Commission recommends turning off remote access on any device you don't need to reach from outside the house, changing the default password it came with, keeping its software updated, and using two-factor authentication where it's offered.
None of these reports identifies the same defect in your kitchen fridge. Still, I'd ask about software support before buying the next one. If the manufacturer expects me to connect it to the internet, it can tell me how long it intends to provide security updates.
Businesses storing medical supplies need more than a promise that someone will fix the software. EFS had staff on duty and other refrigerators available. When the alarms went off, they could move the blood. Anyone buying similar equipment should check whether their own staff would have somewhere to put it.