Cyberattack disrupts blood storage refrigeration systems in France

A refrigeration supplier’s cyberattack affected systems controlling cold-storage chambers at three French Blood Establishment facilities. Attackers raised temperature and defrost settings to extremely high levels. This mattered because the chambers held plasma, blood products, and biological samples that require controlled storage before use or distribution.

EFS monitoring and alarm systems detected the temperature changes quickly. Staff either fixed the affected refrigeration equipment or transferred products to other facilities. Plasma bags for transfusions and plasma used to manufacture medicines were secured or moved before damage occurred.

EFS reported no health impact and no loss of blood products. Blood collection and distribution continued without interruption. Its technical teams are working with France’s national cybersecurity agency, ANSSI, and the Ministry of Health. EFS has also strengthened monitoring of refrigeration equipment and temperatures. The incident shows how a supplier’s connected control system can affect critical healthcare operations.

The French Blood Establishment, known as Établissement français du sang or EFS, manages France’s national blood system. Its responsibilities include collecting blood, processing it into usable products, and distributing those products across the country. That makes its storage facilities an important link between donation and patient care.

EFS keeps blood products in cold-storage chambers before distribution to hospitals. The facilities also store biological samples. In this incident, they held plasma bags intended for transfusions and plasma used to manufacture medicines. Staff protected those products by securing them or transferring them to other refrigeration facilities.

EFS said blood collection and distribution continued without interruption. It also reported no health impact and no loss of blood products. After the incident, EFS worked with ANSSI and the Ministry of Health, while strengthening refrigeration and temperature monitoring. The event highlights the operational importance of reliable storage between processing and hospital delivery.

The blood-storage incident affected three EFS facilities. That is a much smaller number than the estimated 250 to 350 French supermarkets hit by related refrigeration attacks in October. The comparison shows that the same broader attack pattern reached both retail food systems and a national healthcare supply chain.

At the affected EFS sites, attackers changed temperature and defrost thresholds in cold-storage chambers. In the supermarket incidents, hackers reportedly compromised refrigeration controllers and activated automatic defrosting, raising temperatures and forcing stores to discard fresh and frozen products. A second wave affected more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.

The EFS facilities avoided reported product loss because alarms detected the changes and staff repaired or moved equipment and products. Operations continued. The wider scale of supermarket attacks shows that vulnerable connected refrigeration systems can affect many sites, while the EFS case shows the stakes can be especially serious in healthcare storage.

Cold-storage failures can put blood products and biological samples at risk. If temperatures rise beyond safe limits, products may become unsuitable for transfusion, medicine production, or continued storage. If a defrost function switches off cooling, temperatures can climb further and damage stored materials. The article does not specify exact safety thresholds or the precise damage caused by each product.

At EFS, attackers raised temperature and defrost thresholds to extremely high levels. The affected chambers stored plasma bags for transfusions, plasma used to manufacture medicines, and biological samples. EFS alarms detected the changes, so staff repaired equipment or transferred products to other refrigeration facilities.

EFS reported no loss of blood products and no health impact. Plasma was either moved or secured before damage occurred. Blood collection and distribution continued normally. The incident nevertheless shows why temperature alarms, rapid response procedures, backup refrigeration, and close oversight matter when connected cooling systems support healthcare operations.

A connected supplier can become a pathway into a customer’s physical operations. EFS said it was not directly targeted. Instead, the cyberattack involved its refrigeration supplier, whose equipment and remote monitoring software were connected to systems used at EFS facilities. Changing that supplier-controlled layer changed conditions inside EFS cold-storage chambers.

Coolworld Rentals confirmed that a cybersecurity incident affected a limited number of its refrigeration units. It said attackers exploited a vulnerability in a third-party component outside Coolworld’s direct control. At EFS, the attack raised temperature and defrost thresholds. That gave the remote attacker influence over refrigeration without directly attacking EFS’s own network.

EFS alarms detected the changes and staff repaired equipment or transferred products. Coolworld said it responded promptly and was working with affected customers. EFS is working with ANSSI and the Ministry of Health and has strengthened monitoring. The case shows why supplier access and connected equipment need careful security oversight.

Remote monitoring systems collect information such as equipment status and temperatures, then allow authorized users to manage refrigeration from another location. Refrigeration controllers are the devices that monitor and control cooling equipment. These connected tools improve oversight and convenience, but they also create a digital route to physical machinery.

The article describes attacks that changed temperature settings or activated defrost functions. It also reports two 2025 vulnerabilities in Danfoss AK-SM 8xxA controllers that could let attackers bypass authentication and execute commands remotely. The article does not confirm that those specific flaws were exploited in these attacks. Coolworld separately said a third-party component vulnerability was involved.

The practical result can be serious: a remote command may raise temperatures or stop cooling. EFS alarms detected its changes, while supermarkets reportedly discarded fresh and frozen products. Organizations therefore need strong monitoring and rapid response around connected controllers. The article also shows that software weaknesses can translate into physical disruption.

Essential cold-storage operations need safeguards that work even when connected controls are compromised. The article identifies several practical measures: independent monitoring and alarms, rapid technical response, stronger oversight of equipment and temperatures, and arrangements for moving products to other refrigeration facilities. These controls can limit damage when remote settings change.

EFS provides a concrete example. Its alarms quickly detected altered temperature and defrost thresholds. Staff repaired affected equipment or transferred products elsewhere. Plasma bags for transfusions and plasma used to manufacture medicines were either moved or secured. This response prevented reported product loss and allowed blood collection and distribution to continue.

EFS is strengthening refrigeration monitoring and working with ANSSI and the Ministry of Health. Organizations can also reduce exposure by reviewing supplier-connected systems and vulnerable controllers, although the article does not list a complete security program. The central lesson is resilience: detection, human intervention, alternate storage, and coordinated response must operate together.