Hackers changed refrigeration controls at three sites operated by France’s national blood service, prompting staff to secure stored plasma and move supplies before any products were damaged.
The Établissement français du sang (EFS) said the November 2 incident affected equipment managed through a refrigeration supplier, with no interruption to blood collection or distribution.
The incident follows attacks on supermarket and food-supplier refrigeration systems in Europe. At the EFS facilities, however, the affected cold rooms held plasma intended for transfusions and the manufacture of medicines, along with stored biological samples.
In its November 3 statement, EFS said temperature and defrost thresholds had been changed to extremely high settings. Its monitoring and alarm systems detected the changes, allowing staff to intervene before the stored products were affected.
“No health consequences have been identified, and no blood products were lost,” the organisation said.
Staff Intervened Before Plasma Was Damaged
According to Le Canard enchaîné, whose reporting was also covered by TF1, the attack occurred overnight from November 1 to 2. Settings on equipment normally maintained around minus 30°C were reportedly changed to 110°C.
That figure describes a programmed setting, not a temperature the plasma reached. EFS confirmed that operating thresholds had been altered but did not publish the 110°C figure itself.
An on-duty technician reportedly noticed the problem during the night. Depending on the installation, staff brought the equipment under control or took it out of service and transferred products to other cold-storage facilities.
EFS said neither the plasma nor its stored samples were damaged. The organisation has strengthened equipment and temperature monitoring while its technical teams work with France’s national cybersecurity agency, ANSSI, and the Health Ministry.
Investigators are examining how the hackers gained access, which equipment was affected and the conditions required to return installations to service safely.
Supplier Points to a Third-Party Component
Although EFS did not identify its refrigeration supplier in its statement, Le Canard enchaîné named Coolworld, including in connection with facilities in Bourgogne-Franche-Comté.
Coolworld subsequently acknowledged a cybersecurity incident involving refrigeration remote-monitoring software. In its November 4 statement, the company said a limited number of its units had been affected and attributed the vulnerability described in media reports to a third-party component outside its direct control.
The company said it had taken protective measures and was supporting customers where needed, but declined to discuss individual cases. Its statement did not identify the component or explain how the hackers accessed the affected systems.
Similar Attacks Have Disrupted Food Businesses
The EFS incident follows attacks on refrigeration systems at European supermarkets and UK food suppliers. Those incidents involved altered temperature settings, defrost functions and, in some cases, disabled alerts. Several retailers had to discard food.
French supermarkets experienced similar disruption in October. Investigators have not established whether the EFS incident involved the same hackers or access method.
For healthcare facilities, independent alarms and staff intervention can determine whether tampering becomes a loss of medical supplies. At EFS, both allowed employees to act before the products were damaged.
Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, highlighted that distinction in comments shared with Hackread.com.
“There’s also an important distinction between changing a temperature setpoint and changing the physical temperature. We shouldn’t confuse an attempted manipulation with a confirmed physical consequence. Fortunately, the reported monitoring, alarms, and staff response appear to have prevented damage.”
Damon Small, a board member at Xcape, Inc., said access to equipment affecting human safety requires strict controls.
“Any device capable of affecting human safety that is connected to the Internet must have strong authentication and access controls. Access should be restricted to authorized users through appropriate filtering and security mechanisms. These systems deserve the same level of protection as any other critical operational technology.”
