French authorities reported late Tuesday that a cyberattack on several blood banks attempted to raise storage temperatures to dangerously high levels, but the attack was stopped before any blood products or samples could be damaged.
The French Blood Establishment (EFS), the national blood service, said in a statement that on Monday, "temperature and defrosting thresholds were raised to extremely high levels" at three of its cold-storage sites for plasma. The attack targeted a supplier of refrigeration equipment used by the EFS.
"No health consequences have been identified and no blood products were lost," the EFS said. The stored products included bags of plasma intended for transfusions and plasma used to manufacture medicines. These were either transferred to safe locations or secured on site.
The EFS credited its monitoring and alarm systems for quickly detecting the anomalies, allowing staff to intervene and ensure that no blood products or samples were compromised. Blood collection and distribution operations remain uninterrupted, ensuring continued services for patients at hospitals and other healthcare facilities.
Wider pattern of attacks on cold chains
The incident comes amid a series of similar cyberattacks across Europe targeting refrigeration systems in supermarkets. This week, retailers in several European countries reported that their fridges and freezers had been remotely taken over, causing temperatures to rise and leading to tonnes of spoiled food, with costs running into millions of euros.
In Belgium, for instance, a cyberattack on supermarket chains left fridges empty and caused an estimated €100,000 in spoiled food. The attacks have also hit stores in other countries, including Italy, where Sicilian Coop stores were affected. In total, nine European countries have reported such incidents.
Security experts say the attacks appear to exploit vulnerabilities in internet-connected refrigeration units, which are often managed remotely by suppliers. The French blood bank attack suggests that critical medical infrastructure is also at risk, raising concerns about the broader implications for public health and safety.
"This is a wake-up call for all sectors that rely on cold chains," said a cybersecurity analyst based in Paris, who asked not to be named. "If attackers can target blood plasma, they can target vaccines, organs, and other temperature-sensitive materials."
The EFS has not disclosed which supplier was affected or whether any personal data was compromised. The agency said it is working with French cybersecurity authorities to investigate the attack and strengthen its defenses.
The French government has not yet issued a public statement on the incident, but the health ministry is reportedly monitoring the situation. The attack comes as France faces other challenges, including student blockades and a looming nationwide strike, though officials say there is no known connection.
This incident also highlights the growing threat of cyberattacks on critical infrastructure, a concern echoed by UK officials who have warned of AI-driven attacks by 2028. The NCSC chief has urged organizations to bolster their cyber defenses.
For now, the EFS assures the public that the blood supply is safe and that all services continue as normal. The agency says it is reviewing its security protocols to prevent future incidents.
