Hackers heated France's blood-plasma cold rooms at 3 sites, and no blood products were lost

France's national blood service, the Etablissement francais du sang (EFS), says hackers took control of the monitoring and control systems of cold rooms at three of its sites on Monday, November 2, and pushed temperature and defrost settings to extremely high levels. Staff caught it before any blood product was damaged, the Associated Press reported. It is the first known hit on health infrastructure in the wave of refrigeration attacks that has already struck supermarkets in France, Belgium, Sweden and Ireland.

What is confirmed

• Three sites, one supplier. EFS says it was not the direct target: the attack reached a refrigeration provider whose systems monitor and control cold rooms at three EFS sites (TheNextWeb, CNBC).
• What was stored. Frozen plasma for transfusions, plasma used to make medicines, and samples for the service's biobanks, according to CNBC's account of the EFS statement.
• What the attackers changed. In EFS's words, "temperature and defrost thresholds were set to excessively high levels" (as quoted by CNBC).
• No loss. EFS reports no health impact and no lost blood products. Depending on the site, equipment was brought back under control or shut down, and products were moved elsewhere. Collection and hospital deliveries continue.
• Response. EFS is working with the national cybersecurity agency ANSSI and the Health Ministry and has stepped up temperature monitoring. The ministry said the monitoring and alarm systems protected supplies, and that it has begun investigating how the incident happened, according to France 24.

What is disputed or unknown

The temperature. EFS has not published a figure. The satirical weekly Le Canard enchaine, which broke the story, reported units set to 110C instead of about minus 30C. TheNextWeb says an EFS official told Radio France's local network ICI that readings reached 110C and even 150C, but that no samples were altered. France 24 flagged the 110C figure as possibly an error. We treat both numbers as unconfirmed. For scale, the supermarket freezers hit on November 2 reached 50C, according to a franchise manager quoted by Reuters (see our earlier report).

The supplier's name. Le Canard enchaine and Newsweek name the contractor as Coolworld. EFS has not confirmed that, and Newsweek said it received no reply from the company when it asked. We are not treating the name as established.

Who did it, and how. No group has claimed responsibility, no ransom demand has been reported, and officials have not said who is behind it. It is not yet clear how the attackers got in or how many devices were affected (TheNextWeb).

Is it the same campaign as the supermarket freezers?

Not established. The overlap is real: the target is again refrigeration control, and the effect is again heat. But no official source we found links the two, and Newsweek notes that public accounts do not show the same method was used. The consequences also differ, spoiled food in stores versus plasma and samples in storage.

What ANSSI's computer emergency team, CERT-FR, has published concerns the supermarket wave. Its alert CERTFR-2026-ALE-012, first issued October 12 and last updated October 16, says it knows of "numerous compromises" of remote controllers for refrigeration plants: Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb. It does not mention the blood service, and Newsweek reported that ANSSI did not tie the alert to this incident. Whether the EFS supplier used those devices has not been said.

The CERT-FR advice is worth knowing for anyone with a walk-in cooler or freezer on a remote portal:

• Remove direct Internet exposure of the controller.
• Check the whole configuration, especially defrost schedules.
• Restore access only through a secure VPN or protected network. A quick filter on the refrigeration contractor's IP addresses is a stopgap, not a fix.
• For Danfoss units: update firmware, set the security level to strict, and make sure default passwords were changed.
• Check insurance terms before cutting the data link to your refrigeration contractor.

Why this one is different, and who it touches

A supermarket loses stock and sales. A blood service stores a product that cannot be rebought on a spot market, and the damage would show up in hospitals rather than on a profit line. Here the alarms worked and a technician noticed a rising temperature overnight, per Anadolu and Newsweek, so the cost looks limited to staff time and moved stock. We found no figure for it.

The same exposure sits with any small operator running remotely managed cold storage: a pharmacy with vaccines, a clinic, a lab, a caterer, a restaurant. The lesson from both incidents is that the weak point is the contractor's remote link and the controller, so the useful question for a supplier is who can reach your units from the Internet, and whether a separate battery alarm would still go off if the network settings were changed.

What to watch

• Whether EFS or the Health Ministry publishes a temperature, confirms the supplier, or names the equipment involved.
• Whether ANSSI or prosecutors link the blood-service incident to the October supermarket attacks.
• A claim of responsibility, or a ransom demand. Neither has been reported.

Sources: Associated Press via Times of Israel (Nov 4); CNBC (Nov 4, quoting the EFS statement); TheNextWeb; France 24; Newsweek; CERT-FR alert CERTFR-2026-ALE-012. We could not load the EFS press release itself in this run, so EFS statements are as quoted by these outlets. This is news reporting, not investment advice.