Ing. Calogero Bono
The Établissement français du sang (EFS), the public body that collects and distributes blood in France, has confirmed a cyberattack on the systems that remotely control some of its refrigerated cells. According to the weekly Le Canard enchaîné, everything happened during the night between 1 and 2 November. The target was reportedly a supplier, not the agency directly. The case matters because it follows attacks on supermarket freezers and moves the problem from grocery shopping to healthcare.
A few terms before we get into the facts. Supervision system is the software that lets you remotely control the temperature and functions of a facility. Plasma is the liquid part of blood, used in transfusions and to make medicines. Biobank is a collection of biological samples kept for treatment and research. ANSSI is the French national agency for information security. Remote access is the ability to connect to a device from outside the site.
What happened at the French blood bank?
According to DDay, the EFS confirmed the incident to BFMTV after the Canard enchaîné report. The agency maintains there were no health consequences and no product losses.
According to Cybersecurity360, three sites were hit. The attackers reportedly altered the temperature and defrost commands.
Who was actually hit?
The EFS specifies that it was not hit directly. The incident would involve the supervision systems of the supplier, installed at "some sites" of the agency.
Le Canard names Coolworld as the target, the company that maintains the refrigerated containers. The weekly mainly cites Bourgogne-Franche-Comté, in eastern France.
This is the shape of the supply chain. The target is not the hospital but whoever manages its facilities, and the French health ministry has disabled remote access to the equipment involved.
What temperatures were set?
The cells were kept at -30 °C and, according to Le Canard, would have been programmed to reach 110 °C. The EFS has not stated the temperatures actually reached.
HDblog writes that a swing like that would be enough to make blood and plasma bags unusable. The cells held products awaiting delivery to hospitals, samples for biobanks and plasma destined for LFB, the public laboratory that produces medicines.
How did the EFS respond?
According to the agency, alarms flagged the anomaly immediately. Depending on the case, the equipment was either brought back under control or shut down, and products were moved to other cells.
The French health ministry said remote access to the equipment involved was disabled. The EFS is working with ANSSI.
The thread with the supermarkets is clear. We covered it when a new wave hit European supermarkets. Cybersecurity360 reports that NoName057(16) and Z-Pentest claimed the supermarket attacks, not the one on the EFS.
Limits to know
A lot remains unverified. Technical investigations still need to establish how the attack happened, how many devices are involved and when the cells can safely return to operation. The 110 °C figure comes from Le Canard, not from the EFS. A direct link between this episode and the supermarket attacks has not been proven, although it came about three weeks after the October ones. Sources also disagree on the number of sites, as Cybersecurity360 reports three.
What changes for those working with digital systems
Anyone running connected facilities, in healthcare or retail, should also account for the risk coming through a supplier. Ask whoever handles maintenance what remote accesses exist and who uses them. Disable the ones you don't need, as the French ministry did. Make sure temperature alarms work independently of the supervision system. For the Italian guidance, read what changes for those managing connected facilities and what to do.
Our take
The most serious detail is not the 110 °C, but the fact that a weak link outside the agency was enough. The EFS claims it was not hit directly, which is technically true, but for plasma that changes little. As long as remote maintenance is treated as a contract detail rather than as an attack surface, similar episodes will keep happening. The alarms worked, and that is the good news. It should not, however, be read as proof the system holds, because a slower attack could go unnoticed.
Frequently asked questions
Was blood lost?
According to the EFS, no. The agency says there were no health consequences and no product losses. This version has not yet been verified by independent investigations.
Was the EFS hacked directly?
No, according to the agency. The incident involves the supervision systems of a supplier, installed at some sites. Le Canard names Coolworld as the company hit.
How high did the freezers heat up?
Not confirmed. Le Canard says the cells were programmed to reach 110 °C starting from -30 °C. The EFS has not stated the temperatures actually reached.
When did the attack happen?
During the night between 1 and 2 November, according to Le Canard enchaîné. The episode came about three weeks after the October attacks on French supermarkets.
Does it affect Italy too?
Not directly. The attack on the EFS took place in France. The supermarket attacks, however, also spread to Italy, and Cybersecurity360 reports effects on Italian health security.
What to watch for in the coming weeks on remote access to facilities
The French investigation will show whether this was an isolated case or a replicable pattern. For now, technical confirmations are what matter.
- Follow the results of the ANSSI investigation into the attack vector and the number of devices involved.
- Check whether claims linked to the supermarket waves appear.
- Ask facility suppliers for an up-to-date, verifiable log of remote accesses.
