After the freezer attacks: how safe is pharma’s cold chain?

After the freezer attacks: how safe is pharma’s cold chain?

Early in November, a wave of cyberattacks hit supermarket refrigeration across several European countries. In Ireland, Sweden, Belgium, Luxembourg, the Netherlands and Estonia, fridges and freezers in dozens of stores were pushed to high temperatures, forcing retailers to pull chilled and frozen stock fr om sale. Some stores reported temperatures set as high as 50°C. No group has claimed responsibility, and authorities have not said who was behind the attacks. If a fridge can be turned up to 50°C, the same logic applies to any device that records or controls temperature. For clinical supplies, that’s a question worth asking.

Could something similar reach the equipment that protects clinical trial supplies and medicines? To answer that, we asked Mark Woolf, COO at COREX, who has spent more than twenty years moving temperature-sensitive products across borders.

Mark, first, let’s talk a bit more about temperature monitoring. How does it work in our industry?
A temperature logger sits inside a shipper or storage unit and records the temperature at set intervals. Some loggers simply store that data and are read when the shipment arrives and is downloaded at its destination. Others are part of a connected system: they transmit readings over a network in near real time, so the sender and receiver can see what is happening while the shipment is still moving. The second kind is what the industry usually means by IoT, or connected monitoring. However, hacking would not increase the temperature of a passive shipper but can interfere and provide false temperature readings through the monitor.

Connected systems give faster alerts and better visibility, but every connection is also a way in, which is why the security of any connected device matters.

Taking all of it into account, can the supermarket attacks happen in pharma logistics?
“Yes, it can happen. But it’s important to be precise about what kind of equipment is exposed. IoT requires that equipment is connected to the internet or part of a system that broadcasts data. Low-level attacks are theoretically possible, and that’s why the risk needs to be managed, not ignored.”

So how does COREX manage it?
“Our storage systems run as a closed system, not on a public server. And our shipments are mostly domestic rather than regional or international, which keeps the risk profile lower. And of course, we manage every one of these risks through the quality and IT security systems. Any exposure linked to networked equipment should be identified and assessed, weaknesses reviewed with IT specialists, and software updated when needed. It’s part of how we work every day, not a response to a headline. The industry is used to oversight and visibility through quality, and cyber risk is handled the same way. We take it seriously, but there’s no panic.”

So wh ere is the real risk, then?
“It’s mostly about data. A logger on its own gives you a temperature reading and little else. It doesn’t tell you what product is inside or where it’s going. The risk grows when someone combines logger data with shipment details like dates, routes and identifiers, which is why data security matters more than the device itself.”

What should sponsors look for?
“Ask how it assesses risk, what it has done about the weak points it has found, and how it keeps clients informed. A good provider will have clear answers.”

If you want to talk about how COREX approaches temperature monitoring and data security, our team is happy to talk it through for your study.

Back to the list