French Blood Bank Freezers Hit by Cyberattack

Hackers raised the temperature settings on plasma freezers at three sites run by France’s national blood service, according to the French Blood Establishment (EFS). Staff detected the anomaly through monitoring and alarm systems, moved or secured the affected products, and reported no loss of blood products or samples. Blood collection and distribution continued without interruption.

What happened at the EFS sites

The EFS said the incident occurred on Monday at three of its cold-storage sites for plasma. The affected products were bags of plasma intended for transfusions and plasma used to manufacture medicines. The agency said the temperature and defrosting thresholds were raised to extremely high levels.

Some reports put the setting at 110°C. The EFS statement describes the change as “extremely high levels” without publishing the exact setpoint, so the precise number should be treated as reported detail rather than the agency’s official figure. The important point is the direction of the change: a system designed to hold plasma at a deep-frozen temperature was commanded toward heat.

The response depended on the layers around the controller. Monitoring and alarm systems detected the anomaly quickly, and staff transferred or secured the products. The EFS says no blood products or samples were compromised and no health consequences were identified. Blood collection and distribution remained operational for hospitals and other healthcare customers.

Why a freezer setpoint is a safety control

Medical cold storage is a physical safety system with a software interface. Plasma has to stay within a validated temperature range; a controller that accepts a remote setpoint change can move the product outside that range without anyone touching the freezer. The damage is not limited to spoiled inventory. A compromised cold chain can interrupt transfusions, force emergency sourcing, and create a public-health problem that starts as a network incident.

The EFS result was the good outcome: detection before loss. It also exposes the margin. The alarm worked, staff responded, and the products were saved. A different timing, a disabled alarm, or a controller that ignored manual override could have produced a very different story. The near miss carries the lesson.

Refrigeration controllers are often managed as facilities equipment rather than IT assets. They may run older firmware, accept vendor remote access through a shared account, and sit on a flat network with office computers. An attacker who reaches that controller can change setpoints, switch a unit into defrost mode, or disable the alarm that would have caught the change. The defensive work is to treat the controller as a security-critical endpoint with a known owner, a patched firmware baseline, and a monitored network path.

The wider refrigeration campaign

The EFS attack follows a series of refrigeration incidents at supermarkets in Europe. In early November, dozens of stores in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland reported temperature spikes in fridges and freezers. The BBC reported that around 40 Delhaize stores in Belgium and Luxembourg were affected, along with smaller numbers of shops in the other countries. One Swedish store said its units had been set to 50°C.

A Belgian refrigeration manufacturer, Sabcobel, told local media that the units’ evaporators were switched to defrost mode, the same method believed to have been used in an earlier attack on hundreds of French supermarkets. The French supermarket incident in October caused food losses and fires, according to France 24. Those cases are about food waste and business disruption; the EFS case raises the stakes because the product is medical.

Investigators have not publicly attributed the EFS incident to the same actor behind the supermarket attacks. The similarity is in the target class and the method, not in a confirmed link. The distinction changes the response: a broad campaign against exposed refrigeration controllers calls for industry-wide patching and network isolation, while a targeted attack on a blood service would call for a different investigation into motive and access.

The common thread is the equipment. Internet-connected cooling systems are remotely monitored and maintained, often by third-party service providers. When those connections are poorly segmented, a stolen vendor credential or an exposed controller becomes a path to physical consequences. The French supermarket cases and the EFS case all point at the same control plane.

What is confirmed, and what is not

Confirmed by the EFS and French authorities:

The incident affected three EFS plasma cold-storage sites.
Temperature and defrost thresholds were raised to extremely high levels.
A refrigeration-equipment supplier was involved.
Monitoring and alarms detected the anomaly, and staff transferred or secured the products.
No blood products or samples were compromised, and no health consequences were identified.
Blood collection and distribution continued without interruption.
France’s national cybersecurity agency and the Health Ministry are investigating.

Not confirmed at the time of writing:

The identity of the attacker or the country of origin.
A link to the supermarket refrigeration attacks.
The exact setpoint used at each site. The 110°C figure appears in news reports; the EFS statement says “extremely high levels.”
How the attacker reached the supplier’s equipment, and whether a stolen credential, an exposed interface, or a vulnerable device was the entry point.
The number of sites or customers outside the three EFS locations that may have been exposed through the same supplier.

The absence of a confirmed link does not make the supermarket cases irrelevant. It means the investigation is still open. The defensive checklist is the same either way.

Defenses for connected refrigeration

The controls below apply to blood banks, hospitals, supermarkets, and any facility that runs remote cooling equipment. They are not a complete security program; they are the minimum set for the control plane that can change a physical setpoint.

Inventory every controller. Record the model, firmware version, network address, owner, vendor, and remote-access path. A controller that is not in the asset inventory will not be patched or monitored.
Remove direct internet exposure. Put controllers behind a segmented network and require access through a managed gateway with authentication and logging. A vendor “temporary” port forward is still an internet-facing control system.
Replace shared and default credentials. Use unique accounts per site and per technician. Disable dormant accounts and require multi-factor authentication on the remote-access path where the vendor supports it.
Alert on setpoint changes. Log every temperature, defrost, and mode change with the user, source address, and time. Send the alert to staff who can act, not only to an inbox nobody watches overnight.
Keep a manual override. Staff need a way to take local control and hold the unit at a safe temperature when the remote controller is untrusted. Test that procedure before an incident.
Patch the vendor chain. Ask the supplier for a firmware baseline, a patch cadence, and a notification process for vulnerabilities. If the vendor cannot answer, treat the equipment as a known risk and compensate with network controls.
Monitor the physical layer. Independent temperature sensors and alarms can catch a controller that has been reprogrammed or taken offline. Do not rely on the same device for control and verification.
Run the tabletop. Walk through a setpoint change at 2 a.m., including who sees the alert, who can shut the unit down, who calls the vendor, and who decides whether to move the product. The EFS response worked because those roles existed.

Questions for the refrigeration vendor

Procurement teams can turn the incident into a short vendor questionnaire. The answers should be specific and verifiable.

Confirm the vendor’s remote-access path and whether the customer can disable it without losing local control.
Confirm the credential model: unique credentials per unit, or a shared default across installations.
Confirm that setpoint changes, defrost-mode changes, and alarm disables are logged and exportable.
Confirm the firmware support window and the notification process for security fixes.
Confirm that the controller can be isolated on a dedicated VLAN, and list the ports and protocols it needs.
Confirm the fail-safe behavior when the network is unavailable: hold the last setpoint, fail safe, or default to a hazardous state.
Confirm the vendor’s incident-response contact and customer-notification process.

The EFS case is a reminder to put the answers in the contract, before the freezer warms up.

Bottom line

The French blood bank attack did not compromise blood products, and that is the result of detection and human response. It also shows that a refrigeration supplier can become a path into a medical cold chain. The 110°C figure is alarming, but the durable lesson is the control path: an internet-connected setpoint is a safety-critical interface, and it needs the same inventory, segmentation, logging, and vendor accountability as any other production system.

For facilities that have not reviewed their cooling controllers, the supermarket wave and the EFS near miss are a useful warning. Start with the inventory, remove direct internet exposure, and make sure the alarm reaches someone who can act at 2 a.m. The next incident may not have as good an ending.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: