Members of the Dutch Tweede Kamer have raised formal questions to Minister Hermans of Public Health regarding a cyber attack attempt on the cooling systems of the French blood bank.
The French blood bank disclosed on Tuesday that attackers had attempted to increase the temperature of three cooling installations. The manipulation was detected in time, preventing any disruption to blood storage operations.
In response, CDA MPs Zwinkels and Poortman submitted a series of detailed questions to the minister. They asked to what extent the Cyberbeveiligingswet requires blood banks and other critical care institutions to proactively manage cybersecurity risks, including those involving digitally controlled equipment and external suppliers.
The MPs also requested clarification on whether coordinated efforts are underway to develop emergency plans and physical fallback options when critical equipment or infrastructure is disabled or manipulated by a cyber attack.
Further questions addressed the Cyber Resilience Act (CRA). The MPs want to know whether digitally controlled cooling equipment used by blood banks falls under the CRA, which cybersecurity requirements and risk classifications apply, and what responsibilities manufacturers have regarding cybersecurity and timely vulnerability remediation.
Finally, the minister is asked to explain how legal responsibility is divided between manufacturers, suppliers, and users when such equipment is targeted, and whether more information is available about the attackers. Hermans has three weeks to respond to the parliamentary questions.
