Hackers raised cold room temperatures at three sites of France's blood service

Hackers have tampered with the cold rooms of France's national blood service. On 2 November, the control systems of cold storage rooms at three sites of the Établissement français du sang (EFS) were altered so that "temperature and defrosting thresholds were raised to very high levels", the EFS said in a statement on 3 November. According to the blood service, no blood products were lost and patients were not affected. The intrusion came through a refrigeration equipment supplier rather than the EFS's own network.

What happened at the blood service

The cold rooms at EFS preparation and distribution sites hold blood products before they go to hospitals, as well as samples for the service's biobanks. In the rooms that were hit, these were bags of plasma for transfusion and plasma meant to be processed into medicines.

The EFS says its own monitoring and alarm systems spotted the anomalies quickly. Depending on the site, staff either brought the equipment back under control without harm to the contents or switched it off, moving the stored products to other facilities as a precaution. Blood collection and deliveries continue. The service is working with ANSSI, France's national cybersecurity agency, and the health ministry, and has stepped up temperature monitoring on all its equipment.

An EFS spokesperson could not say which three sites were affected, who made the control systems or which model they were, The Record reports. The supplier has not been named.

A second wave across Europe

The blood service is the first healthcare organisation known to be hit in a wave of attacks on refrigeration controls that has so far targeted mostly supermarkets. In mid-October, hackers switched fridges in hundreds of French stores to defrost mode, spoiling food stocks. A second wave followed in the early hours of 2 November, the same day as the EFS incident.

That night, more than 50 stores were affected in Belgium, a "limited number" of smaller shops in Sweden and over a dozen more in Ireland, Estonia, the Netherlands and Luxembourg, The Record writes. A supermarket manager in southern Sweden said the freezers had been set remotely to 50°C. In all, businesses in at least 11 European countries, including Germany, Finland, Portugal and the UK, have reportedly been hit.

Nobody has claimed responsibility, and it is not known whether the October and November attacks were carried out by the same people. "It is not known who is behind this attack, and it may never be possible to identify them," a spokesperson for the Centre for Cybersecurity Belgium told The Record.

Why old controllers are the weak point

In Estonia, a contractor said the attackers got into an older Danfoss system, and Dutch broadcaster NOS reported that Copeland equipment was targeted in Belgium. Both manufacturers said that the devices hit after the French attack were mostly discontinued products that no longer receive security updates. The French stores in October were reached through remote controllers exposed to the internet. A Belgian installer said about 20 of the hundreds of units it manages were affected and that they need physical modifications, not just a software update.

For now, manufacturers have no legal duty to fix such products. Stricter security requirements under the EU Cyber Resilience Act only begin to apply in December 2027.