French blood banks thwarted cyberattack that targeted refrigeration systems

Incident at French blood banks

On 1–2 November 2026, the French Blood Establishment (EFS) reported that its cold‑storage monitoring and control systems at three regional sites were affected by a cyberattack. The attack raised temperature and defrosting thresholds to extremely high levels, potentially jeopardising plasma bags stored at –22 °F (–30 °C). French authorities confirmed that no blood products or samples were lost and that no health consequences had been identified. The incident occurred concurrently with a wave of attacks on supermarket refrigerators across eight European countries, which forced retailers to discard large quantities of food. The French health ministry said that staff had been alerted by monitoring systems and moved plasma to other refrigerators that were not connected, keeping supplies intact.

Background

The EFS is the national blood collection service responsible for gathering and distributing blood and plasma for transfusions and medicine manufacture. The cyberattack targeted refrigeration equipment supplied by Coolworld, a company that stated it was aware of the incident and that the vulnerability involved a component from a third‑party supplier outside its direct control. Only a limited number of units were affected. Earlier in October 2026, French supermarkets, including the Dutch chain Ahold Delhaize, were hit by a similar attack that forced the removal of spoiled food and caused estimated losses of up to €250 million in sales and €100 million in operating income. The current attacks mirror that earlier episode, raising concerns about the security of internet‑connected consumer and critical‑infrastructure technology.

Why it matters

The attacks highlight the vulnerability of essential services that rely on networked refrigeration systems. While the blood banks were able to prevent any loss of plasma, the incident underscores the potential risk to patient care if such systems were not monitored or if staff were not able to respond quickly. The fact that the attacks were linked to a component supplied by a third‑party vendor also raises questions about supply‑chain security for critical medical equipment. The European Union has expressed heightened concern over these incidents, citing the broader context of cyber‑security tensions following Russia’s 2022 invasion of Ukraine. The attacks may prompt regulators to review standards for connected infrastructure in healthcare and retail settings.

What happens next

France's national cybersecurity bodies and the Health Ministry are currently examining the breach, with their inquiry centered on the attack's methodology, the specific hardware compromised, and the timeline for safely restoring system operations. As a preventive step, the health ministry has shut down remote connectivity to the compromised refrigeration units. No further details on the perpetrators or the exact technical method have been released. The EFS confirmed that the gathering and delivery of blood products have not been disrupted, guaranteeing that hospitals and other medical institutions continue to receive their necessary supplies.