I recently warned that cyberattacks on Europe’s refrigeration systems were only beginning. Hackers had already demonstrated that they could destroy enormous quantities of food without dropping a bomb or firing a shot. Now they have gone after something far more dangerous. France’s national blood service has confirmed that hackers remotely manipulated refrigeration systems at three facilities storing blood plasma used for transfusions and pharmaceutical production. The attackers attempted to raise freezer temperatures to extraordinary levels, with reports indicating that some settings were changed from -30°C (-22°F) to as high as 110°C (230°F). We are no longer discussing spoiled groceries. We are discussing the ability to interfere with medical supplies that hospitals depend upon to keep people alive.
The attack occurred overnight between November 1 and 2, affecting facilities operated for the French Blood Establishment (EFS). Fortunately, monitoring systems detected the abnormal temperatures, and personnel transferred or secured the blood products before any damage occurred. No blood supplies were lost, and hospital services were not interrupted. But that outcome depended upon the vigilance of personnel and the availability of alternative refrigeration. What happens when the next attack occurs at multiple hospitals simultaneously, or when backup facilities are compromised as well? Blood plasma is essential for treating severe bleeding, trauma victims, and patients undergoing certain medical procedures. Destroying those reserves could have consequences extending far beyond the financial losses associated with ruined food.
This follows an extraordinary series of attacks on European supermarkets. In October, hackers reportedly compromised refrigeration equipment at as many as 700 French supermarkets, remotely manipulating temperatures and causing substantial food losses. Another wave struck retailers across Europe this week, affecting stores in Belgium, Ireland, Sweden, Finland, Estonia, Luxembourg, the Netherlands, and elsewhere. Some refrigeration systems were reportedly pushed to 50°C (122°F), destroying perishable inventory and leaving businesses with millions of euros in losses.
These are not sophisticated assaults nor are they harmless pranks. Investigators have identified vulnerabilities in internet-connected refrigeration controllers, including outdated equipment that no longer receives security updates. The devices were installed to make operations more efficient by allowing technicians to monitor and adjust temperatures remotely. Yet that same convenience can provide outsiders with access to equipment responsible for preserving food, medicine, and blood products. A hacker sitting thousands of miles away may be able to interfere with essential supplies without ever entering the country.
We have spent decades connecting practically everything to the internet under the assumption that greater automation necessarily represents progress. Refrigerators, warehouses, hospitals, water systems, transportation networks, and electrical infrastructure increasingly depend upon software and remote access. The problem is that every connection creates another potential point of failure. A vulnerability in one commercial supplier can expose hundreds of customers who may not even realize that their equipment is accessible from outside their own networks. The attack on the French blood facilities reportedly involved a refrigeration equipment supplier rather than a direct intrusion into the blood service’s central computer systems. That is precisely why this problem is so difficult to contain.
There is also a psychological dimension that governments should not underestimate. Empty supermarket refrigerators and reports of threatened blood supplies undermine public confidence in the ability of institutions to protect basic necessities. The European Commission has acknowledged that these incidents require a coordinated response, while national cybersecurity agencies are investigating. Yet the identity and motives of the attackers remain unknown. No group has credibly claimed responsibility, and there is insufficient evidence to conclude that a foreign government directed the operations. Some analysts suspect politically motivated sabotage, while others believe an individual or criminal group may be exploiting widely accessible vulnerabilities. The uncertainty itself is troubling because authorities cannot yet establish whether the attacks are coordinated or how far they may extend.
Traditionally, destroying a nation’s food or medical supplies required physical attacks against warehouses, transportation routes, or production facilities. Today, similar disruption may be achieved by manipulating the software that controls storage conditions. An adversary could theoretically target refrigerated medicines, vaccines, laboratory specimens, or other temperature-sensitive supplies. That does not mean these facilities have already been compromised, but the attacks in France demonstrate that the underlying danger is real. The distinction between civilian infrastructure and potential targets for sabotage is becoming increasingly blurred.
This should also concern Americans. In August, refrigeration failures at commissaries on several US military bases prompted an investigation into possible cyber interference. Authorities have not established that those incidents were connected to the European attacks, but the similarities warrant examination. The United States depends upon the same types of interconnected commercial technology used throughout Europe. An outdated controller does not become secure simply because it is installed on American soil.
The attackers have now demonstrated that they can interfere with the systems preserving both food and lifesaving medical supplies. Fortunately, the French blood service prevented any loss of plasma, but that should not diminish the seriousness of what occurred. The next facility may not detect the intrusion quickly enough. The next supplier may have no alternative storage available. And the next attack may affect something that cannot be replaced before patients or consumers suffer the consequences.
Europe is discovering that its vulnerability extends well beyond military installations and government computer networks. The systems sustaining ordinary civilian life are increasingly exposed to remote interference. We have constructed a society dependent upon digital connections without adequately protecting the physical infrastructure those connections control. The attacks on supermarkets were a warning. The attempted destruction of blood plasma shows just how dangerous this form of sabotage could become. The frightening reality is that someone can now threaten a nation’s essential supplies without ever crossing its borders.
