EFS reports no plasma losses after cyberattack on blood storage
Manipulated cold-room controls affected three sites. According to EFS, alarms prevented product losses, and blood collections and hospital deliveries continued.
At three sites of the French blood service EFS, attackers manipulated the controls of cold rooms. A supplier of refrigeration equipment was affected on 2 November. EFS's monitoring and alarm systems detected the unusual settings in time. According to the service, no blood products were lost, and no health consequences were identified.
The facilities stored plasma intended for transfusions and for the manufacture of medicines, among other things. Staff secured the stocks or moved them to other facilities as a precaution. Blood collections and distribution to hospitals continued, according to EFS. The statement of 3 November therefore describes an intercepted attack on the cold chain, not a failure of the French blood supply.
Besides the plasma bags, the service names samples held for its biobanks. The affected rooms belong to sites where blood products are prepared and distributed. The issue was thus stored stocks and samples, not merely the registration of blood donors.
The access ran through an equipment supplier
EFS states that it was not directly the target of the incident. The company attacked was one whose solution enabled the monitoring and control of the affected cold rooms. The intruders changed operating parameters: temperature and defrost thresholds were set to very high values.
The difference from ordinary office IT is immediately visible here. A changed entry in a control system can affect the operation of a physical facility. In this case, the products concerned must be kept refrigerated before they are handed over to health facilities. EFS therefore had to check the settings and at the same time ensure the safety of the stocks.
The French health ministry confirmed to Reuters that monitoring and control systems of individual cold rooms were affected. The situation was under control and was being closely monitored. Investigators are examining the sequence of events, the devices that may have been affected, and the conditions and timetable for a safe restart.
110 degrees is not a confirmed room temperature
The weekly newspaper "Le Canard enchaîné" reported, according to AP, that systems normally set to minus 30 degrees had been reprogrammed to a target value of up to 110 degrees. In its own statement, EFS names no specific temperature. It describes altered threshold values and the timely reaction to them.
Such a target value does not mean that the cold room or its contents reached that temperature. Measurement logs would be decisive for the actual course of events. The EFS statement contains neither a measured peak value nor the duration of each individual disruption. The widely circulated figure must therefore not be read as proof of heated or destroyed plasma.
Coolworld points to a third-party component
Coolworld, a refrigeration equipment rental company named in media reports, published its own statement on 4 November. The company confirmed a cyber incident in connection with remote monitoring software for refrigeration systems in early November. The reported vulnerability concerns a component from a third-party provider outside its direct control.
Only a limited number of its own systems had been affected, Coolworld stated. It had reacted quickly and was supporting customers where necessary. The company does not comment on individual cases. This account shows neither which manufacturer supplied the component nor which specific access rights the attackers used.
The earlier warning does not replace an investigation
As early as 12 October, the French cyberdefence agency CERT-FR had warned about compromised remote controls on refrigeration systems. The advisory, updated through 16 October, names Danfoss, Copeland and Dixell. On its own, however, it does not establish which of these systems was in use at the three EFS sites.
CERT-FR recommends, among other things, removing administrative interfaces from the publicly reachable internet and restoring remote access only through protected networks. The entire configuration, including defrost times, must also be reviewed. Simply resetting an outdated device without security updates does not permanently remove the vulnerability.
At the same time, refrigeration systems at European supermarkets were attacked again. A common timing and similar manipulations are not enough, however, to establish the same perpetrator or the same access route. For the blood service, the next task is already named: its technical teams are working with the cyber authority ANSSI and the health ministry. Operational and temperature monitoring at all EFS facilities has been strengthened.
Sources
- EFS: statement on the incident of 3 November 2026
- Coolworld: statement of 4 November 2026
- CERT-FR: warning on remote controls of refrigeration systems, as of 16 October 2026
- Reuters via StreetInsider: confirmation by the health ministry
- AP: report on the attack and the 110-degree figure
- Lead image: Andykatib, plasma bag in Dunedin, CC0
- Lead image licence: CC0 1.0
- Article image: Ufficio Comunicazione, Azienda Ospedaliera SS. Antonio e Biagio e Cesare Arrigo, Alessandria
- Article image licence: CC BY-SA 4.0
