Cyberattack on French blood banks exposes risks to critical cold-storage systems
An attempted temperature manipulation at three plasma-storage sites was stopped before any products were damaged, but the incident follows costly attacks on European supermarkets and highlights the vulnerabilities of connected infrastructure.
A cyberattack targeting refrigeration equipment at three French blood-storage sites has renewed concerns about the security of critical infrastructure, after hackers attempted to push storage temperatures to extreme levels. French authorities said the incident was detected before it could damage blood products or samples, but its timing has drawn attention to a wider series of attacks involving internet-connected cooling systems across Europe.
The French Blood Establishment (EFS) said temperature and defrosting thresholds were raised to extremely high levels on Monday at three of its plasma-storage facilities. Monitoring systems identified the abnormal settings, allowing staff to intervene and secure or transfer the stored products. The organisation confirmed that no blood products or samples were compromised and that collection and distribution operations continued without interruption.
French weekly newspaper Le Canard Enchaîné, which first reported the incident, said the attempted manipulation sought to raise temperatures from the normal storage level of minus 30 degrees Celsius to as high as 110 degrees Celsius. The EFS did not independently confirm those specific figures in its statement.
The affected facilities stored plasma intended for transfusions as well as material used in the manufacture of medicines. The incident involved a supplier of refrigeration equipment, rather than a direct compromise of the blood bank’s entire operational network. Coolworld, the equipment supplier, said the reported vulnerability involved a component provided by a third party and was outside its direct control. It added that a limited number of units had been affected and that corrective measures were underway.
France’s national cybersecurity agency and Health Ministry are investigating the incident. Authorities have not identified a suspected perpetrator or indicated who may have been responsible.
The attempted attack illustrates how cyber threats can affect physical processes even when digital systems are not directly responsible for delivering a service. Refrigeration controls are essential to preserving temperature-sensitive medical products. Manipulating those settings can potentially undermine the safety and usability of stored materials without physically entering a facility.
In this case, monitoring systems and staff intervention prevented damage. That outcome demonstrates the importance of operational safeguards alongside cybersecurity measures. Detecting an unauthorised change is only one part of the response; facilities also need the ability to isolate affected equipment, transfer vulnerable products and maintain services while an incident is investigated.
The implications extend beyond blood banks. Hospitals, pharmaceutical manufacturers, laboratories and food distributors depend on controlled storage environments. A disruption to refrigeration can create financial losses, interrupt supply and, in healthcare settings, threaten the availability of essential products.
The French incident does not establish that all connected refrigeration systems are vulnerable in the same way. It does, however, show why equipment suppliers, third-party components and remote-management systems must be included in the security planning of organisations that operate essential services.
The blood-bank incident follows a series of cyberattacks in mid-October that affected refrigeration systems at hundreds of supermarkets and independent stores across France, Belgium and the Netherlands. The attacks caused refrigerators and freezers to warm up, leading to large quantities of spoiled food and disruption to retail operations.
The financial consequences have become clearer through the latest disclosure from Dutch supermarket group Ahold Delhaize. The company said on Wednesday that the incident could reduce its fourth-quarter sales by as much as $281 million, equivalent to approximately €250 million. It also expects operating income for the period to be reduced by more than $112 million, or around €100 million.
Chief executive Franz Muller said that although most of the disruption had been contained within two weeks, work was continuing to restore normal operations. The company had previously taken some systems offline as a precaution, including websites and applications serving brands in Europe and the United States.
The figures demonstrate that the impact of a cyberattack is not limited to the cost of repairing compromised systems. When digital controls are connected to physical operations, an intrusion can generate losses through spoiled inventory, interrupted services, reduced sales and prolonged recovery work.
The two episodes expose a common risk associated with the growing use of connected equipment. Remote monitoring and automated controls can improve efficiency, reduce operating costs and help organisations manage facilities across multiple locations. But those benefits also create additional points of exposure when equipment is connected to external networks or depends on components supplied and maintained by third parties.
The responsibility for securing such systems is therefore not confined to the organisation operating the facility. Equipment manufacturers, software providers, component suppliers and service contractors all form part of the wider security chain. A weakness in one component can have consequences for an organisation that does not directly control its development or maintenance.
For businesses and public institutions, the incidents reinforce the need to restrict remote access, monitor unusual changes to operational settings, maintain secure update procedures and establish clear responsibilities with technology suppliers. Critical equipment should also have contingency arrangements that allow essential services to continue when digital controls are compromised.
The French blood-bank attack ended without reported health consequences or product losses. The supermarket incidents, however, show how quickly similar vulnerabilities can translate into substantial commercial damage. Together, they illustrate a broader shift in cybersecurity risk: the potential target is no longer only information stored on a computer, but also the physical conditions on which essential goods and services depend.
Sources
