For the past few weeks, all eyes have been on cyberattacks impacting refrigerators and freezers, first on U.S. military bases, then in French supermarkets, and now expanding across Europe. But now a French bloodbank has been targeted in an incident that should serve as a wakeup call for healthcare organizations. While no blood product was damaged, the reality is that the same controllers regulate grocery aisles and pharmaceutical and blood product refrigeration, and they’re all being targeted by threat actors in rapid succession.
While many headlines for healthcare cyber incidents stem from ransomware or other breaches that start in IT, the risk is moving to internet facing operational technology (OT) assets. Healthcare security leaders must examine the exposure of OT in their environments, and extend that assessment to building management systems (BMS). From medications and vaccines to blood supply, a hospital that loses refrigeration or environmental control would see an immediate impact to patient care. The key to resilience in the wake of these incidents is a solid cybersecurity strategy for OT and BMS in healthcare. Understanding the root causes and blind spots can offer the roadmap to operational resilience.
The Stakes for Healthcare Systems: Patient Risk
Research by Claroty’s Team82 revealed vulnerabilities in refrigeration controllers made by Danfoss and Copeland long before the ongoing attacks. And this vulnerability is not exclusive to these manufacturers. Controllers from other vendors are critical in healthcare environments, from ultra-low temperature (ULT) freezers to climate-controlled storage for vaccines, blood plasma, biological therapeutics, and clinical trial samples, which rely on connected BMS controllers. Imagine how a forced defrost or thermal drift would wreck damage on high-value medicine and halt patient care.
Besides the clear patient safety risk, an incident of this magnitude is also expensive, with potential single loss expectancies (SLE) reaching $25M along with severe compliance penalties.
The Root Cause: Third-Party Blind Spots and Internet Exposure
Healthcare systems looking to shore up OT security and uncover blind spots should look to CERT-FR’s advice that exposing a management interface on the internet goes against common security practices. Organizations regularly find these units exposed because integrators, vendors, and partners deploy direct internet portals for off-site troubleshooting. These third-party contractor connections often bypass access controls, creating unmonitored entry points into the network. Other common sense strategies include putting these assets behind a firewall or secure access solution and changing default passwords.
Third-party blind spots are a widely recognized issue for healthcare security leaders. In a recent Claroty survey, 52% of healthcare leaders said they have only partial or no monitoring of external connections into operational networks, with 65% of healthcare respondents experiencing between 1 and 10+ operational security incidents originating specifically from third-party connections in the past year. This type of exposure is exactly what healthcare systems looking to improve their security posture in light of these incidents must address.
Actionable Steps to Secure Healthcare OT
Operational resilience in healthcare depends on having a comprehensive strategy for OT. In addition to examining your operational readiness, take the following steps immediately:
Immediate Triage for Affected Units: Assess asset inventories to identify the device manufacturers being targeted (Danfoss, Copeland, and Dixell units) and determine the internet exposure of affected controllers. Remove exposed assets from the internet immediately for affected units and all devices on public IP addresses.
Lock Down Vendor Access: Replace insecure direct contractor logins by restoring system access exclusively via a secure VPN or purpose-built secure remote access solution, change default passwords, enforce identity-based least privilege, and two-factor authentication.
Segment and Enforce Zones: Isolate these assets in order to contain the blast radius of an attack and prevent lateral movement. Beyond the current attack scenario, lateral containment is imperative to keep IT breaches from reaching OT or BMS networks and isolating management interfaces to protected network segments.
Vulnerability Management: Remind systems administrators to update device firmware to the latest security release for devices supported by their vendors and change all factory default passwords.
Strategic Steps for Operational Resilience
The healthcare response to these recent cyber incidents should be to double down on the outcomes that keep patients safe: risk reduction, maintaining compliance, and operational resilience. In the interim, Claroty can map external exposures in 15 minutes to identify devices like the targeted controllers and see if they are unintentionally exposed. Reach out to one of our experts to learn more.
