Key facts
- The EFS said the attack hit three sites and affected equipment storing plasma for transfusions and medicine manufacturing.
- The EFS said it was not directly targeted; the cold stores were run by its contractors.
- The EFS said ANSSI and the health ministry were alerted and monitoring of its equipment was reinforced.
- Retailers in Italy, Germany, Romania and the UK were targeted on Tuesday, after seven other European countries reported refrigeration problems.
- EU spokesperson Thomas Regnier said the incidents were not isolated and that EU agencies were discussing a collective response.
- A regional branch of Crédit Mutuel said on Wednesday it had been the victim of a cyberattack.
France's national blood service, the EFS, said a cyberattack on a refrigeration supplier raised temperatures to very high levels at three cold stores stocking blood products. The EFS said the attack occurred overnight on Monday and that its alarm systems let technicians intervene before the products were compromised. The EFS said it was not directly targeted and that the affected equipment was run by its contractors.
The EFS is France's public blood transfusion operator, collecting, testing, preparing and distributing blood, plasma and platelets to more than 1,900 hospitals. The affected rooms held plasma bags for transfusions and medicine manufacturing; the EFS said those products were moved to other sites. The EFS said France's national cybersecurity agency, ANSSI, and the health ministry had been alerted and monitoring of all its equipment had been reinforced.
The attack sits within a wave of incidents against refrigeration systems across Europe. Hackers seized control of cooling units in as many as 700 French supermarkets last month, according to Le Canard enchaîné. Retailers in Italy, Germany, Romania and the UK were targeted on Tuesday, after Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems the previous day, with temperatures reaching as high as 50C (122F) and causing millions of euros of food damage.
A regional branch of France's Crédit Mutuel bank said on Wednesday it had been the victim of a cyberattack. In early August, a series of fridge malfunctions hit commissaries at at least six US military bases, and the Pentagon is investigating a suspected hack. After Italy's government held emergency talks with intelligence chiefs on Tuesday, EU spokesperson Thomas Regnier said the bloc's agencies were holding urgent discussions with national authorities to formulate a collective response. "These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents," Regnier said, declining to name possible culprits. No motive for the attacks is known and no one has claimed responsibility. Rafe Pilling, senior director for threat intelligence at cybersecurity company Sophos, told the Guardian the most plausible attribution scenarios were a "state-based signalling and demonstration of capability" or a lone-wolf hacker.