French Blood Service Says Hackers Raised Temperatures at Three Plasma Storage Sites, No Products Lost

Since hackers began seizing supermarket refrigeration controls in France in mid-October, the attacks have spread across Europe. As of today, Wednesday, Nov. 4, they have reached medical storage.

The Établissement français du sang (EFS), France's public blood transfusion operator, said in a statement late Tuesday that "temperature and defrosting thresholds were raised to extremely high levels" on Monday, Nov. 2, at three of its cold-storage sites for plasma. The French Health Ministry confirmed Wednesday that several regional blood banks were hit on Nov. 2 and that the situation is under control.

What EFS says was hit

The attack struck a supplier of refrigeration equipment serving the three EFS sites, according to the statement. The stored products were bags of plasma intended for transfusions and plasma used to manufacture medicines. Staff either transferred or secured them.

"No health consequences have been identified, and no blood products were lost," EFS said. It added that "monitoring and alarm systems quickly detected the anomalies, allowing staff to take action." Blood collection and distribution have continued without interruption.

EFS collects, tests and distributes blood, plasma and platelets to more than 1,900 hospitals and supports more than a million patients a year.

France's national cybersecurity agency, ANSSI, and the Health Ministry are investigating.

The 110-degree claim

More detail comes from the French weekly Le Canard Enchaîné, which reported Tuesday that the target was Coolworld, a company that maintains cold rooms for EFS, including in the Bourgogne-Franche-Comté region. Le Canard says the attack came overnight from Sunday to Monday and that units normally held at minus 30°C (minus 22°F) were reprogrammed to reach 110°C (230°F).

EFS has not confirmed that figure, Coolworld's role, or the exact location of the affected sites. Its statement says only "extremely high levels." The Health Ministry told reporters there were no operational consequences because the temperature rise was detected in time.

There is also a discrepancy in what was stored. EFS describes plasma. Le Canard's account, as relayed by Anadolu Agency, refers to donor blood samples kept as part of a health-monitoring system tied to transfusions. EFS has not reconciled the two descriptions publicly.

A wider campaign with no claimed author

The blood bank incident follows a wave across European retail. Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported refrigeration problems on Monday. Italy, Germany, Romania and the UK followed on Tuesday. Temperatures in some supermarket units climbed as high as 50°C (122°F), and the damage to food runs to millions of euros.

The October wave in France was larger. France's finance minister said about 700 of the country's 10,000 supermarkets were affected. ANSSI said it has been investigating incidents since mid-October, and the inquiry has focused partly on older refrigeration systems and software that had not received security updates.

A regional branch of Crédit Mutuel, the French bank, also reported a cyberattack Wednesday. Crédit Mutuel Arkéa said customers face no losses. No source has linked that incident to the refrigeration attacks.

In the US, a series of fridge malfunctions hit commissaries at at least six military bases in early August. The Pentagon is investigating a suspected hack.

Who is behind it

No one has claimed responsibility and no motive is known. After Italy's government held emergency talks with intelligence officials Tuesday, EU spokesman Thomas Regnier said EU agencies are in urgent discussions with national authorities on a collective response. "These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents," he said. He declined to name any culprit.

Western intelligence officials say Moscow is running a sabotage campaign in Europe that takes many forms, and some authorities and experts fear state-sponsored hybrid attacks since Russia's 2022 invasion of Ukraine. No official has tied these incidents to Russia.

Rafe Pilling, senior director of threat intelligence at the security firm Sophos, told the Guardian this week that the most plausible explanations are a "state-based signalling and demonstration of capability" or a lone-wolf hacker.

The exposure

Commercial refrigeration can be monitored and controlled remotely, and unpatched internet-connected software leaves that code open to attack. Katerina Mitrokotsa, a cybersecurity professor at the University of St. Gallen in Switzerland, put it this way: "We have filled our homes and shops with devices that are really small computers, yet we still treat them like ordinary appliances."

The French case shows what that means for a public health system. The reported entry point was a contractor's equipment, not EFS's own network. The thing that stopped the damage was a set of alarms and staff who acted on them.

The open questions are specific. ANSSI and the Health Ministry have not said how the attackers got into the supplier's systems or whether the same vulnerabilities used against the supermarkets were exploited. EFS has not said whether any of the affected material needs retesting. The EU's promised collective response has no announced date.