A cyberattack altered the refrigeration controls at three French blood-service sites on Nov. 2, but monitoring systems and rapid intervention prevented any loss of blood products or samples, the Établissement français du sang (EFS) said in an official statement.
The incident affected a refrigeration-equipment provider rather than the EFS directly. Attackers changed temperature and defrost thresholds in the supervision and control systems used for cold rooms, creating a potentially serious risk to plasma stored for transfusions, plasma used in medicine manufacturing and biological samples held in EFS biobanks. The EFS said affected equipment was either brought under control or taken offline, while products were moved preventively to other facilities.
“No health impact has been identified and no loss of blood products” occurred, the agency said. Blood collection and distribution continued without interruption, according to reporting by The Associated Press. The episode nevertheless demonstrates how compromise of a supplier’s operational-technology environment can cross into healthcare infrastructure without attackers breaching a hospital network or manipulating patient records.
The blood-bank incident coincided with a broader wave of attacks against internet-connected refrigeration systems at supermarkets in Europe. Agence France-Presse reported that retailers in at least nine countries experienced freezer or refrigerator failures, while SecurityWeek reported that investigators had examined exposed Danfoss AK-SM and AK-SC controllers in earlier French incidents. The connection between those attacks and the EFS event has not been established publicly.
No CVE, public proof of concept, in-the-wild exploitation notice or threat-actor attribution was identified in the EFS statement or the public reporting available at publication time. Defenders operating cold-chain environments should therefore treat the event as an operational-technology and third-party risk warning: remove refrigeration controllers from direct internet exposure, restrict remote administration, enforce multifactor authentication and vendor access controls, maintain independent temperature alarms, and regularly test manual failover and product-transfer procedures. The EFS said it had reinforced monitoring across its refrigeration equipment.
