The CSIRT team of the e-Health Centre (CeZ) has issued a warning to Polish medical facilities about cyberattacks on cooling systems that store blood, plasma and drugs. The warning follows incidents in Western Europe, including an attack on the French blood service.
What the e-Health Centre CSIRT warns about
The warning was published on November 4 on the csirt.cez.gov.pl website. In it, the CSIRT CeZ draws attention to the growing number of incidents in Western Europe targeting operational technology (OT) systems and the technical infrastructure supporting critical processes. Control systems for cooling equipment are increasingly becoming targets.
The team stresses that attacks on systems responsible for storing blood, plasma, drugs and other biological materials may lead to operational disruption, material losses and a threat to the continuity of medical services. Healthcare entities have been advised to "maintain heightened vigilance" and to continuously monitor their technical infrastructure.
The incident in France
The direct reason for the warning is an attempted unauthorised change to the operating parameters of cooling systems used by the French blood service. According to CSIRT CeZ, blood samples and plasma intended for medical use may have been at risk. The French Ministry of Health reported that on Monday, November 3, the blood banks of the French Blood Service were attacked, affecting monitoring systems and control systems at some of the cold storage facilities.
CSIRT CeZ also points to waves of attacks on refrigeration equipment in shops. According to the team, one successful attack on a shop refrigeration unit has also been confirmed in Poland.
Recommendations for hospitals and other entities
The warning is addressed to the entire healthcare sector, not only to hospitals. Among other things, CSIRT CeZ recommends:
- verifying the security of cooling, storage and other OT systems,
- reviewing the permissions of administrators and external suppliers,
- separating the OT network from the office network,
- limiting remote access to the necessary minimum and controlling it,
- isolating unsupported or un-updated devices,
- removing default access and replacing it with new credentials, in line with a strong password policy,
- strengthening monitoring of configuration and operating parameter changes in critical devices,
- testing incident response procedures and business continuity plans.
As of publication, there is no information about a successful attack on a blood or drug refrigeration unit at a Polish medical facility.
