Cyberattack Targets Three French Plasma Storage Sites, but No Blood Products Are Lost

A cyberattack affecting refrigeration controls at three French plasma-storage sites was detected before it damaged blood products or biological samples, France’s national blood service said. The incident involved systems operated by a refrigeration-equipment supplier, rather than a direct intrusion into the French Blood Establishment itself. Monitoring alarms alerted staff to abnormal temperature and defrost settings, allowing them to secure or move the stored products.

The episode highlights how cyber risks can reach healthcare supply chains through connected industrial equipment and outside service providers. But authorities have not identified the attackers, established their motive or confirmed that the incident was part of the same campaign targeting supermarkets across Europe.

Three sites affected through a refrigeration supplier

The French Blood Establishment, known by its French initials EFS, said several regional facilities were affected by a cybersecurity incident involving monitoring and control systems for cold-storage rooms. The incident occurred around November 2 and affected three plasma-storage locations.

The facilities held plasma bags intended for transfusions, as well as plasma used in the manufacture of medicines. Some affected sites also stored biological samples. EFS said temperature and defrost thresholds had been raised to extremely high levels. Officials have not publicly identified the three locations, disclosed the equipment models or provided a complete technical account of how the attackers gained access.

The Health Ministry described the situation as under control and said the safety of blood supplies had been preserved through monitoring systems and immediate precautionary measures. The incident affected equipment associated with a refrigeration service provider.

Alarms helped staff prevent damage

EFS said its monitoring and alarm systems quickly detected the anomalies. Staff then took steps to secure the affected equipment and protect the products. Depending on the circumstances at each site, equipment was brought under control or taken out of service, while products in the affected cold rooms were moved preventively to other facilities or otherwise secured.

The organization reported no loss of blood products, no compromised samples and no identified health consequences. Blood collection and distribution continued without interruption, meaning the incident did not result in a reported disruption to hospital supply.

Some media reports, citing the French investigative weekly Le Canard enchaîné, said attackers attempted to change a setting from a normal level of about minus 30 degrees Celsius to 110 C. That figure describes a reported target setting in the control system. It does not mean the rooms or plasma actually reached 110 C. EFS’s public statement said only that temperature and defrost thresholds had been raised to extremely high levels; it did not independently confirm that the physical temperature reached the reported figure.

Supplier points to a third-party component

EFS said it was not directly targeted; the incident affected systems connected to its refrigeration-equipment supplier. Coolworld, identified in media reports as the supplier, said the vulnerability being discussed involved a component provided by a third party and was outside Coolworld’s direct control. The company said only a limited number of its units were affected and that it had taken response measures.

Those statements do not yet establish the precise technical route used in the attack. Public information has not identified a vulnerability number, explained how access credentials or remote connections may have been obtained, or established whether any information was stolen. It is also not clear whether the incident involved a software flaw, compromised credentials, a supplier-side service or a combination of weaknesses.

France’s national cybersecurity agency, ANSSI, and the Health Ministry are investigating. The Health Ministry said remote access to the affected refrigeration equipment had been disabled. Authorities are examining the method of intrusion, the equipment potentially involved and the conditions required before remote services can safely resume.

Part of a wider wave of refrigeration incidents?

The attack came amid reports of cyber incidents affecting supermarket refrigeration systems in several European countries. Recent disruptions have been reported in places including France, Belgium, the Netherlands, Sweden, Ireland, Finland, Luxembourg and Estonia. In some stores, changes to refrigeration controls or defrost functions caused food to warm and retailers to discard stock. France also experienced a larger wave of attacks against supermarket refrigeration systems in October.

The overlap in timing and equipment type has raised questions about whether the incidents are connected. However, no public investigation has established that the EFS incident and the supermarket attacks were carried out by the same individuals or group. No perpetrator has publicly claimed responsibility, and authorities have not announced an attribution.

The incidents illustrate a broader operational-technology risk. Refrigeration equipment is increasingly monitored and managed remotely, often through supplier platforms and components made by multiple vendors. That connectivity can help operators oversee equipment across many locations, but it can also create additional access paths. A weakness in a third-party component or remote-management system may affect customers that did not develop or directly operate the vulnerable technology.

For healthcare organizations, the consequences of a prolonged refrigeration failure could be particularly serious. Plasma and other temperature-sensitive materials must be stored under controlled conditions. A successful attack could threaten inventories, complicate distribution and force facilities to move products under time pressure. In this case, alarms, staff intervention and contingency measures prevented a reported loss.

What remains unknown

Several important questions remain open. Authorities have not disclosed who was responsible, why the sites were targeted or whether the attackers intended to destroy plasma, disrupt operations or demonstrate access to industrial control systems. The exact vulnerability and the full scope of affected equipment have also not been made public.

The confirmed outcome is narrower but significant: three EFS storage sites were affected, the abnormal settings were detected, products were secured or transferred, and no blood products or samples were reported lost. EFS collection and distribution continued. Until investigators publish further findings, claims about the attackers’ identity, motives or links to other European incidents should be treated as unverified.

The case is a reminder that healthcare cybersecurity extends beyond patient records and hospital networks. Refrigeration controls, supplier connections and other physical systems that protect medical materials are also part of the healthcare infrastructure that must be monitored, segmented and secured.