609/69 Thursday, November 5, 2026
France’s national blood service, Établissement français du sang (EFS), disclosed a cyberattack on November 2, 2026, that affected temperature-control systems at three blood-product storage facilities. Attackers altered temperature and defrost settings to abnormal levels, creating a risk that stored plasma and biological samples could be damaged. EFS stated that it was not directly targeted but was impacted through an attack on a refrigeration service provider. However, monitoring and alerting systems detected the abnormal conditions in time, allowing staff to take protective action. No blood products were reported lost, no patients were affected, and blood collection and distribution operations continued normally.
The attackers were able to remotely access refrigeration-control software and modify device settings without authorization. Coolworld Rentals, a service provider involved in the incident, confirmed that a security issue affected refrigeration monitoring software and stated that the relevant vulnerability was located in a third-party component. No CVE identifier or detailed attack method has been disclosed. After detecting the anomaly, EFS personnel contained the incident, shut down affected equipment, and moved blood products to alternative storage locations as a precaution. There is currently no confirmed evidence linking this incident to earlier cyberattacks targeting refrigeration systems in the retail sector.
The incident highlights the risks associated with network-connected control systems, particularly those used to store medical products. Administrators should review and restrict access paths to such devices, avoid exposing management interfaces directly to the internet, and require third-party providers to connect through secure channels such as VPNs with appropriate access controls. Systems should be updated according to vendor guidance, operating parameters should be monitored regularly, and independent temperature monitoring and alerting should be deployed separately from the primary control system. Organizations should also maintain contingency plans for relocating stored products when abnormal conditions are detected to minimize losses and maintain continuity of service.