Cyberattack hits French blood banks
Three blood banks have detected and reversed a potentially destructive temperature spike in their cold rooms, following a cyberattack that targeted a refrigeration equipment provider of the French Blood Establishment (EFS), the only civilian blood collection and transfusion organization in France.
Monitoring systems caught the anomalies in time
“Although the EFS was not directly targeted by this cybersecurity incident, anomalies were reported, resulting in changes to the operating parameters of cold rooms equipped with the provider’s solution. Specifically, temperature and defrost thresholds were set to very high temperatures,” the EFS stated on Tuesday.
Cold rooms are where blood banks keep blood and plasma before these are distributed, via the EFS, to some 1,900 healthcare facilities across France.
“The EFS’s monitoring and alarm systems have made it possible to quickly identify these anomalies and to take the necessary measures so that no samples or blood products are altered,” the organization confirmed.
The products have been moved to other facilities, and blood collection and distribution are unaffected, the EFS concluded.
“The EFS technical teams are fully mobilized, working with the French National Cybersecurity Agency (ANSSI) and the Ministry of Health. Monitoring of the operation and temperatures of all our equipment has been stepped up,” the EFS concluded.
Part of a wider wave of refrigeration attacks?
According to the EFS, the still unnamed equipment provider was victimized on November 2, 2026, when the latest wave of cyberattacks targeting refrigeration units in European supermarkets was coming to light.
Initial reports revealed that supermarkets in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, and the Netherlands were affected. Some stores in Portugal and Romania were also targeted.
It is still unknown who’s behind these attacks.
Xavier Bellekens, CEO of cyber deception and threat intelligence firm Lupovis, said that, starting on October 20, the company observed authentication attempts targeting Danfoss AK-SM refrigeration controller sensors.
The authentication attempts were coming from ASNs previously categorized as bullet-proof hosting and used by Russian adversaries, Bellekens told Help Net Security.
“Most adversaries attempted to authenticate using the publicly documented factory-default credentials,” he added. The probing continued until October 30, in an apparent attempt to compromise as many as possible and prepare for a widespread, synchronized attack.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
