Cyberattack Disrupts Blood Storage Refrigeration Systems in France

A significant cyberattack has disrupted refrigeration systems at three facilities managed by France's national blood service, the Établissement Français du Sang (EFS), raising temperatures in cold-storage chambers to extremely high levels ¹². This incident marks the first reported case in France during the second wave of attacks targeting control systems, and notably, it is the first to affect a healthcare organization ².

The attack did not result in any reported health impacts or loss of blood products, thanks to swift action taken by EFS following the detection of the issue ¹². Despite the elevated temperatures, plasma bags intended for transfusions and plasma used to make medicines were either transferred or secured, ensuring that blood collection and distribution operations continued uninterrupted ¹.

Interestingly, the EFS itself was not the direct target of the attack; rather, it was the refrigeration supplier that bore the brunt of the cyber intrusion ¹². The attackers exploited a vulnerability in a third-party component of Coolworld's software, which controls the refrigeration systems ¹. This mirrors a pattern seen in recent cyberattacks affecting refrigeration systems in European supermarkets, where temperature settings were altered or defrost functions activated ¹.

In response to the incident, EFS is working closely with France’s national cybersecurity agency (ANSSI) and the Ministry of Health to address the situation and prevent future occurrences ¹. The collaboration highlights the interconnected nature of healthcare infrastructure and the critical role played by robust cybersecurity measures in safeguarding public health.

This latest wave of attacks follows a similar pattern to the one observed in October, where food spoilage occurred due to remote defrosting of fridges in various locations ². However, there is uncertainty regarding whether the same perpetrators were responsible for both waves of attacks ².

What we know

• - A cyberattack disrupted refrigeration systems at three EFS facilities ¹²
• - Temperature and defrost settings in EFS's cold-storage chambers were raised to extremely high levels ¹²
• - No health impact or loss of blood products was reported ¹²
• - This is the first reported case in France during the second wave of attacks targeting control systems and the first to affect a healthcare organization ²
• - EFS was not directly targeted; the attack was on its refrigeration supplier ¹²
• - Attackers exploited a vulnerability in a third-party component of Coolworld's software ¹
• - Plasma bags intended for transfusions and plasma used to make medicines were either transferred or secured ¹
• - Blood collection and distribution operations continued without interruption ¹
• - EFS is collaborating with ANSSI and the Ministry of Health ¹
• - Recent cyberattacks also affected refrigeration systems in European supermarkets ¹
• - Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers were targeted in previous attacks ¹
• - Two vulnerabilities in Danfoss AK-SM 8xxA controllers were disclosed by CISA in 2025 ¹
• - At least 11 countries have reportedly been affected in the most recent attacks ²
• - The previous wave of attacks in October caused food spoilage due to remote defrosting of fridges ²

What remains unclear

• - Whether the same perpetrators were responsible for both waves of attacks ²