Cyberattack hits French blood agency's cold storage via supplier

The French Blood Establishment (Établissement français du sang, EFS) says a cyberattack on November 2 reached the systems that monitor and control its cold-storage chambers, pushing temperature and defrost thresholds at three EFS sites to extreme levels. EFS was not the direct target — the attack hit its refrigeration supplier, whose management software controls the cold rooms. EFS says no health impact and no loss of blood products resulted, and that collection and distribution continued without interruption.

The account here follows BleepingComputer, reporting EFS's November 3 statement; French outlet Next, citing Le Canard enchaîné, corroborates the supplier, the three sites and the timing.

What was hit

• Not EFS's own network — the intrusion was at its refrigeration-maintenance supplier. EFS has not named it; Coolworld Rentals confirmed a cybersecurity incident affecting a limited number of its units.
• The supervision and control systems for cold-storage chambers. Per Le Canard enchaîné, chambers were reprogrammed from −30°C toward 110°C; a duty technician caught the temperature climbing.
• Frozen plasma and monitoring samples were among the material affected; EFS says products were transferred or secured in time.

Impact

EFS's line is unambiguous: "No health impact has been identified, and no loss of blood products has been reported." Plasma for transfusion and plasma destined for medicines was moved or protected. EFS says it is working with France's cybersecurity agency ANSSI and the Ministry of Health, and has stepped up monitoring of its refrigeration equipment.

Attribution

None. No group has claimed responsibility and no actor is named. Coolworld said the attackers "exploited a vulnerability in a third-party component" without identifying them or the component.

Action checklist

1. Pull refrigeration and BMS controllers off the public internet. An exposed management interface is the common thread in every incident in this wave — put it behind a VPN, never a public admin panel.
2. Treat your refrigeration vendor's remote-management plane as part of your attack surface. EFS was hit through a supplier; map who can write set-points into your cold chain and how.
3. Alarm on out-of-band set-point changes. A forced write toward 110°C — or a defrost cycle no one scheduled — must page an on-call engineer before product thaws.
4. Inventory OT controllers and firmware against the vendor's support status; isolate end-of-life units on a segmented network.

Context

This is the same playbook that spoiled stock across Europe over the past month: France's October supermarket refrigeration attacks on an estimated 250–350 stores, then a second wave across six countries on November 2. Belgian installer Sabcobel has said the November incidents exploited the same vulnerability as the October ones. Danfoss AK-SM 800A controllers carry two 2025 CISA-disclosed flaws — CVE-2025-41450 (authentication bypass) and CVE-2025-41451 (command injection) — but it is unconfirmed whether those, or the EFS supplier's own software, were the entry point here. What is confirmed is the pattern: internet-exposed, often end-of-life OT controlling a physical process, now being flipped against hospitals and blood banks rather than only grocery aisles.