France has confirmed that remote cyber attacks against refrigeration systems have escalated to a critical level after three blood banks were targeted. In each location, attackers raised the temperature inside the units from the normal operating level of -30 °C to 110 °C, rendering the stored blood unusable if not relocated immediately.
The compromised equipment consisted of Danfoss refrigeration controllers that remained connected to the internet without recent security updates. Security researchers noted that the same class of devices had already been abused in earlier incidents against European supermarket cold-storage facilities.
Analysis of the intrusion showed that the attackers leveraged a simple but effective flaw: the administrator password on the exposed units is generated in a predictable manner based on the current date. Once the correct password is calculated, an attacker gains full administrative control and can modify any operational parameter, including temperature thresholds.
Following detection of the anomaly, French blood-service personnel immediately transferred all affected blood products to separate refrigeration units that are not connected to any network. No patient impact has been reported, but the incident demonstrates how internet-exposed industrial control systems can directly threaten critical infrastructure such as blood banks.
Authorities continue to investigate the scope of the campaign and urge operators of Danfoss equipment to disconnect legacy devices from the internet or apply available hardening measures without delay.
