Singapore’s blood bank systems unaffected by French cyberattack: HSA

SINGAPORE – Singapore’s sole blood bank service is not affected by the cyberattacks that hit blood banks in France.

The Health Sciences Authority (HSA) has confirmed that it does not use any of the compromised storage and monitoring systems that affected three blood banks in France on Nov 4.

Responding to queries from The Straits Times, the authority said: “HSA has multiple layers of safeguards in place to ensure that blood is stored safely and under appropriate conditions.”

HSA and the Singapore Red Cross jointly run the National Blood Programme, which supplies blood to hospitals here. Donors can give blood at five blood banks or at mobile blood drives.

“These include independent checks, monitoring and alert mechanisms, as well as established procedures to detect and respond promptly to any irregularities,” HSA said of its safeguards.

The authority also said it has plans to keep blood supplies available during disruptions and will continue working with the Cyber Security Agency of Singapore (CSA) to strengthen its safeguards where needed.

Local cord blood bank StemCord also reviewed its systems after reports of the attacks.

Cord blood banks freeze and store blood collected from the umbilical cord and placenta after birth. The blood contains stem cells that can be used to treat certain diseases, including some blood cancers.

StemCord lab director Eddie Yoh said each tank has its own monitoring system and cannot be controlled remotely. The monitors are separate from the tank controls, so someone who gains access to the readings cannot use that access to change the storage temperature.

In France, the Nov 4 attack hit a refrigeration equipment supplier and disrupted the systems that monitor and control cold rooms at the three regional blood banks. Temperature settings were raised from the normal minus 30 deg C to 110 deg C. Alarms alerted staff, who moved blood products to other refrigerators. France’s national blood service said supplies were unaffected.

The first wave of refrigeration attacks hit hundreds of French supermarkets in mid-October. More supermarkets across Europe were affected in early November. Hackers reportedly gained access to the controls over the internet and changed temperature settings, forcing stores to throw away spoiled food.

In a Nov 6 advisory, CSA warned that the same weakness could leave other equipment open to tampering, including systems that control air-conditioning in buildings or equipment used to treat water.

It urged organisations to check which controls can be reached over the internet and block public access. If staff or contractors need to connect remotely, organisations should limit who can log in, require a second identity check where possible and keep software up to date.

CSA also urged organisations to train staff to spot unexpected changes to equipment settings and practise how to keep essential operations running if a system is compromised. That could mean switching to manual controls where possible.