Hackers Target French Blood Bank Freezers via Cooling Vendor, No Patient Harm Reported

Key points

• The attack targeted Coolworld, a refrigeration equipment provider for the French Blood Establishment (EFS), rather than EFS directly.
• Temperature and defrosting thresholds were raised to 'very high levels' at three EFS cold storage sites, including facilities in Bourgogne-Franche-Comté.
• On-call technicians detected the abnormal temperatures overnight, allowing them to intervene and move affected plasma and medicine to other sites before spoilage occurred.
• The incident caused no operational consequences or patient harm, according to France’s Health Ministry and EFS.
• The attack is part of a broader wave of cyberattacks on European refrigeration systems, including supermarkets in multiple countries, but no specific attacker or vulnerability has been publicly confirmed for this incident.

Background

This incident follows a series of cyberattacks on refrigeration systems across Europe in late 2026. In October, hackers targeted approximately 700 French supermarkets, causing temperatures to spike and spoiling food. On November 2, a coordinated attack affected over 100 stores in seven EU nations, including Sweden, Belgium, and the Netherlands. These incidents often exploit legacy industrial hardware, such as Danfoss controllers, with vulnerabilities in firmware and default passwords. The French blood bank attack highlights the risk to critical healthcare infrastructure through supply chain compromises.

How outlets are covering it

Cyber Security News and The Verge emphasize that the 110°C figure refers to a setpoint, not necessarily the actual temperature inside the freezers, and stress that no patient harm or product loss occurred. The Guardian notes the broader context of European-wide attacks on supermarkets and the potential for state-sponsored sabotage, while EFS clarifies it was not directly targeted. All sources agree that staff response and alarm systems prevented damage, but details on the attack method, number of affected units, and specific vulnerabilities remain undisclosed.

Why it matters

The incident underscores the vulnerability of critical healthcare infrastructure to supply chain cyberattacks. While no immediate harm occurred, it highlights the risks of internet-connected industrial equipment and the importance of independent monitoring and rapid response. It also raises concerns about the potential for similar attacks to disrupt essential medical supplies in the future.

What to watch

EFS has reinforced monitoring of all its equipment and alerted France’s national cybersecurity agency (ANSSI) and the health ministry. CERT-FR recommends removing public internet access from refrigeration controllers, updating firmware, changing default passwords, and using secure VPNs for remote access. Investigations into the specific attack method and potential culprits are ongoing, but no public technical findings have been released.