In response to a surge of cyberattacks targeting cold storage facilities across Europe, U.S. government authorities have issued urgent warnings to healthcare organizations and operators of critical infrastructure. Their primary concern is the necessity to fortify protections for internet-connected refrigeration systems essential for preserving blood supplies and medications. The recent wave of attacks has been disruptive, creating significant risks that extend beyond national borders.

This situation is underscored by a joint federal alert issued by prominent U.S. agencies, including the Cybersecurity and Infrastructure Security Agency, FBI, and the departments of Health and Human Services, Agriculture, and Transportation. The alert emphasizes that cybercriminals are actively exploiting vulnerabilities found in industrial refrigeration controllers and cold-chain monitoring systems.

Significantly, these warnings followed a series of cyber incidents that began in mid-October and critically impacted European refrigeration facilities. Numerous supermarkets were forced to discard thousands of euros’ worth of perishable goods after hackers remotely increased temperatures in their refrigeration units. The attacks have continued to evolve, with notable incidents reported in France, where a refrigeration supplier linked to the French Blood Establishment experienced a cybersecurity breach.

Fortunately, the quick response from an on-call technician averted disaster when he identified the temperature anomalies in cold storage facilities before any blood products were compromised. However, the implications of successful cyberattacks could be catastrophic, as hackers might gain the ability to remotely alter temperatures, force refrigeration units into detrimental heating cycles, or compromise vital temperature-sensitive supplies.

John Riggi, a national adviser for cybersecurity and risk at the American Hospital Association, voiced concerns about the expanding cybersecurity risks associated with operational technology. “In the healthcare sector, these refrigeration systems are vital for maintaining the safety and integrity of the blood supply. It is critical that these resources remain within strict temperature parameters,” Riggi explained in an interview.

AHA Advisory

In anticipation of federal guidance, the American Hospital Association (AHA) released its advisory on the same day, urging hospitals to examine the security of their internet-connected operational technology, especially refrigeration units. AHA recommends that hospitals critically assess whether these systems genuinely require internet connectivity and eliminate any unnecessary access points.

Riggi probed further, questioning, “Do these systems genuinely need to be connected to the internet? Is it feasible to disconnect them if practical?” The federal agencies have pointed out that attacks successfully exploit unpatched or easily accessible electronic temperature controllers and commercial refrigeration systems. This vulnerability grants attackers the means to manipulate system settings, resulting in extensive inventory losses and safety hazards.

Advisories recommend implementing several security measures, including strengthening authentication protocols, updating outdated equipment, replacing unsupported legacy devices, and segmenting operational technology networks. Organizations are also urged to ensure that temperature monitoring and alert systems are operating effectively. Simultaneously, the Food and Drug Administration (FDA) issued a parallel warning about the threats posed to refrigeration systems.

The FDA cautioned that recovery from cybersecurity incidents might take anywhere from days to months, severely impacting the manufacturing, storage, and distribution of regulated products, notably crucial blood supplies. Consequently, the agency called on organizations to review their cold-chain infrastructure, identify vulnerabilities, and enhance disaster recovery and continuity plans.

The Legacy Device Challenge

In a significant observation, Riggi remarked that while the increased deployment of internet-connected operational technology in hospitals has enhanced operational efficiency, it has also heightened susceptibility to cyber threats. “Not only is there the challenge posed by new equipment, but older operational technology may have been online long before cybersecurity measures were established, leaving it vulnerable to attacks,” he added.

He continued to highlight a critical issue where visibility into some operational systems may be obscured because facilities departments often procure and deploy equipment without collaborating with cybersecurity teams, leading to potential gaps in protective measures. “These systems may not even have manual overrides, making them entirely reliant on digital mechanisms,” Riggi emphasized.

Scott Gee, the AHA’s deputy national adviser for cybersecurity and risk, spoke about the increasing need for better coordination between facilities management and cybersecurity personnel to safeguard operational technology effectively. To protect these systems, hospitals need a thorough inventory of their operational technology and an understanding of any vulnerabilities present.

Moreover, it’s vital for healthcare organizations to ensure that only essential devices remain on their networks, with properly segmented and controlled access. Just enhancing access controls around these systems is insufficient, according to Marc Josephson, CEO of security firm CORIS Monitoring. He underscored the risks associated with compromised systems that could fail to issue alerts about abnormal operations, emphasizing that independent monitoring systems should be utilized to provide reliable alerts and facilitate rapid responses to potential breaches.

Broader Implications

The latest concerns regarding cyberattacks extend beyond hospital infrastructure to include utilities and third-party service providers that support healthcare organizations. Riggi cited previous Iranian government-linked cyberattacks targeting programmable logic controllers within U.S. water systems as evidence that hospitals must be vigilant against possible indirect threats.

Moreover, federal authorities have yet to confirm if any U.S. blood collection or storage facilities have been impacted by these recent refrigeration system cyberattacks. However, this isn’t the first time alarms have been raised regarding ransomware threats to blood supply organizations, with prior warnings issued in 2024 urging blood suppliers to bolster cybersecurity measures in light of significant disturbances caused by cybercriminal activities.

The recurring theme for critical infrastructure operators is the understanding that any connected device potentially serves as a gateway for cyber adversaries. Josephson cautioned that operational technology systems’ inherent connectivity, designed to optimize management and performance, could inadvertently expose vulnerabilities that lie beneath the radar of conventional cybersecurity defenses focused on IT-related threats. Thus, it is crucial for organizations to deploy robust protections across all critical operational technology systems, including HVAC and other support mechanisms, to mitigate potential risks proactively.