France’s national blood service, Établissement français du sang (EFS), has confirmed a cyberattack affecting refrigeration equipment at three of its facilities after attackers compromised a third-party cooling equipment provider.
The incident occurred overnight November 1–2 and involved unauthorized changes to temperature and defrost settings in cold-storage systems used to preserve blood plasma.
According to French reporting, hackers attempted to change refrigeration settings from approximately -30°C (-22°F) to 110°C (230°F). While EFS confirmed that temperature and defrost thresholds were raised to extremely high levels, the actual temperatures inside the storage units were not confirmed.
Thankfully, its monitoring and alarm systems detected the anomalies and staff disconnected and secured affected equipment and moved blood products to other facilities before any blood products or samples were damaged.
Damon Small, Board Member, Xcape, Inc.
“This incident represents a troubling escalation in an ongoing campaign. Adversaries appear to be pivoting from disrupting food supplies in grocery stores to directly threatening patient care. We should expect these attacks to continue and potentially evolve from nuisance incidents into operations with much more harmful consequences.
“The fact that no group has claimed responsibility for these ongoing attacks in Europe and the United States is telling. This is not cyber vandalism; this is terrorism. As previously reported, the European countries targeted in this campaign share a common characteristic: they have all provided tangible support to Ukraine.
“Any device capable of affecting human safety that is connected to the Internet must have strong authentication and access controls. Access should be restricted to authorized users through appropriate filtering and security mechanisms. These systems deserve the same level of protection as any other critical operational technology.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security
“We’ve spent years telling organizations that third-party access is a security risk. This incident is a reminder that sometimes the consequences aren’t measured in stolen records or encrypted servers, but in degrees Celsius. And when we’re talking about blood plasma, that’s a very different kind of ransomware nightmare.
“From my experience in offensive security, what stands out isn’t simply that attackers reportedly manipulated refrigeration settings. It’s the architectural seam that allowed a compromise involving a third-party provider to affect systems responsible for maintaining critical medical supplies. That’s where the real security questions begin. What authority did that provider have? How was access controlled? Could those changes have been prevented or constrained before they reached the equipment?
“There’s also an important distinction between changing a temperature setpoint and changing the physical temperature. We shouldn’t confuse an attempted manipulation with a confirmed physical consequence. Fortunately, the reported monitoring, alarms, and staff response appear to have prevented damage.
“The lesson isn’t simply to secure the refrigerator. It’s to validate the entire chain of trust, from third-party access to operational controls, independent monitoring, and human intervention. Security isn’t what we assume the architecture will prevent. It’s what we can demonstrate the architecture will withstand when something goes wrong.”
Mark my words. This is just the beginning. More countries are going to be targeted. More environments are going to be targeted. Don’t let you be one of those targeted.
By the way, why do these even need to be on the Internet at all? Asking for a friend.
UPDATE: Aras Nazarovas, Senior Information Security Researcher at Cybernews said this:
“Refrigeration systems are just one example of equipment that can be controlled remotely and therefore compromised. Similar risks exist for heating and ventilation systems, water treatment facilities, pharmaceutical storage, and industrial machinery. If attackers gain access to these systems, they may be able to wreak havoc on other essential services or damage goods, without ever physically entering the attacked facility.”
Why do these attacks keep happening and how can organizations prevent similar attacks?
“Many organizations rely on third-party providers to remotely monitor and maintain their equipment. This may make maintenance easier, but it also means a potential entry point for hackers. If remote access isn’t properly secured, attackers may be able to use stolen passwords or software vulnerabilities to gain control of systems. And once they’re inside, they could change temperature settings just as a legitimate technician would. This is especially concerning when the same service provider manages equipment for multiple organizations – compromising one provider could potentially expose several customers.”
“To stay safe from these attacks, organizations should limit remote access to essential personnel and trusted suppliers, require multi-factor authentication, and keep control systems updated. It is also important to learn from such cases, with the attacks against France’s Blood Banks, they were able to quickly identify the attack and move the sensitive supplies to other, unaffected units. This highlights the importance of constant monitoring and having an actionable incident response plan, especially as these attacks start to become more common.”
Related
This entry was posted on November 5, 2026 at 7:24 am and is filed under Commentary with tags France. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Hackers target blood service refrigeration systems in latest EU cyberattack
France’s national blood service, Établissement français du sang (EFS), has confirmed a cyberattack affecting refrigeration equipment at three of its facilities after attackers compromised a third-party cooling equipment provider.
The incident occurred overnight November 1–2 and involved unauthorized changes to temperature and defrost settings in cold-storage systems used to preserve blood plasma.
According to French reporting, hackers attempted to change refrigeration settings from approximately -30°C (-22°F) to 110°C (230°F). While EFS confirmed that temperature and defrost thresholds were raised to extremely high levels, the actual temperatures inside the storage units were not confirmed.
Thankfully, its monitoring and alarm systems detected the anomalies and staff disconnected and secured affected equipment and moved blood products to other facilities before any blood products or samples were damaged.
Damon Small, Board Member, Xcape, Inc.
“This incident represents a troubling escalation in an ongoing campaign. Adversaries appear to be pivoting from disrupting food supplies in grocery stores to directly threatening patient care. We should expect these attacks to continue and potentially evolve from nuisance incidents into operations with much more harmful consequences.
“The fact that no group has claimed responsibility for these ongoing attacks in Europe and the United States is telling. This is not cyber vandalism; this is terrorism. As previously reported, the European countries targeted in this campaign share a common characteristic: they have all provided tangible support to Ukraine.
“Any device capable of affecting human safety that is connected to the Internet must have strong authentication and access controls. Access should be restricted to authorized users through appropriate filtering and security mechanisms. These systems deserve the same level of protection as any other critical operational technology.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security
“We’ve spent years telling organizations that third-party access is a security risk. This incident is a reminder that sometimes the consequences aren’t measured in stolen records or encrypted servers, but in degrees Celsius. And when we’re talking about blood plasma, that’s a very different kind of ransomware nightmare.
“From my experience in offensive security, what stands out isn’t simply that attackers reportedly manipulated refrigeration settings. It’s the architectural seam that allowed a compromise involving a third-party provider to affect systems responsible for maintaining critical medical supplies. That’s where the real security questions begin. What authority did that provider have? How was access controlled? Could those changes have been prevented or constrained before they reached the equipment?
“There’s also an important distinction between changing a temperature setpoint and changing the physical temperature. We shouldn’t confuse an attempted manipulation with a confirmed physical consequence. Fortunately, the reported monitoring, alarms, and staff response appear to have prevented damage.
“The lesson isn’t simply to secure the refrigerator. It’s to validate the entire chain of trust, from third-party access to operational controls, independent monitoring, and human intervention. Security isn’t what we assume the architecture will prevent. It’s what we can demonstrate the architecture will withstand when something goes wrong.”
Mark my words. This is just the beginning. More countries are going to be targeted. More environments are going to be targeted. Don’t let you be one of those targeted.
By the way, why do these even need to be on the Internet at all? Asking for a friend.
UPDATE: Aras Nazarovas, Senior Information Security Researcher at Cybernews said this:
“Refrigeration systems are just one example of equipment that can be controlled remotely and therefore compromised. Similar risks exist for heating and ventilation systems, water treatment facilities, pharmaceutical storage, and industrial machinery. If attackers gain access to these systems, they may be able to wreak havoc on other essential services or damage goods, without ever physically entering the attacked facility.”
Why do these attacks keep happening and how can organizations prevent similar attacks?
“Many organizations rely on third-party providers to remotely monitor and maintain their equipment. This may make maintenance easier, but it also means a potential entry point for hackers. If remote access isn’t properly secured, attackers may be able to use stolen passwords or software vulnerabilities to gain control of systems. And once they’re inside, they could change temperature settings just as a legitimate technician would. This is especially concerning when the same service provider manages equipment for multiple organizations – compromising one provider could potentially expose several customers.”
“To stay safe from these attacks, organizations should limit remote access to essential personnel and trusted suppliers, require multi-factor authentication, and keep control systems updated. It is also important to learn from such cases, with the attacks against France’s Blood Banks, they were able to quickly identify the attack and move the sensitive supplies to other, unaffected units. This highlights the importance of constant monitoring and having an actionable incident response plan, especially as these attacks start to become more common.”
Share this:
Like this:
Related
This entry was posted on November 5, 2026 at 7:24 am and is filed under Commentary with tags France. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.