Cyberattack on French Blood Bank Cold Rooms: What to Do Now

Weeks after a wave of supermarket refrigeration attacks that began in France, attackers have reached the cold rooms of France’s national blood service and raised their temperature and defrost thresholds to “very high levels.” Alarms caught it. No blood was lost.

The attackers went through one of the blood service’s refrigeration suppliers. Many hospitals, labs, pharmacies, and food distributors run cold storage that a supplier monitors and controls remotely in the same way.

Here is what we know, and what to do this week.

What Happened

• Where it hit: The Établissement français du sang (EFS) says the attack on November 2 “was not against itself, but on one of its providers,” the company that monitors and controls its cold rooms. Cold rooms at three regional sites were affected.
• What changed: “Temperature and defrost thresholds were raised to very high levels,” EFS said. Le Canard enchaîné reported settings of 110°C, against a normal plasma storage temperature of about −25°C. EFS has not confirmed a figure.
• What was at risk: Plasma for transfusions, plasma used to manufacture medicines, and biobank samples.
• Why no blood was lost: The French health ministry said blood supplies were preserved “thanks to the facilities’ monitoring and alarm systems, as well as precautionary measures immediately implemented.” Units were brought back under control or taken offline, and plasma was moved.
• Who did it: Unknown. EFS told Sky News it is “not in a position to comment on the origin of the cyber incident or identify those responsible.” How the attackers got in has not been disclosed, though France’s cybersecurity agency, ANSSI, is involved in investigating and managing the response.

Part of a Wider Wave

In October, refrigeration at hundreds of French supermarkets was remotely heated; French investigators said a Danfoss software vulnerability may have enabled it. On November 2, the same day as the EFS incident, supermarkets in six more countries reported fridges and freezers warming, reportedly after remote takeover, including 13 of SuperValu’s 223 Irish stores (Sky News). Le Monde reported that attackers stretched defrost cycles from one hour to eight to slip past alarms.

The pattern is consistent: supplier-managed refrigeration controllers, reachable from outside, with settings an attacker can change. The targets have moved from groceries to blood. Attackers can reuse the same tactics, techniques, and procedures (TTPs) against a new target. Defenders have to move faster than attackers can.

What to Do Now

You do not need to run a blood bank to be exposed. If you have cold storage, building controls, or any equipment a vendor reaches remotely, start here:

1. Find every supplier-managed device. List the refrigeration controllers, building management systems, and monitoring gateways on your network, including those a contractor installed. If it is not in your inventory, nobody is watching it.
2. Ask your suppliers four questions. How do you connect to our equipment? Who holds the credentials? When were your platform and our controllers last patched? Have you seen suspicious activity in the last 60 days? Get the answers in writing.
3. Remove direct internet exposure. Controller management interfaces should not be reachable from the internet. Allow only the connections each device needs.
4. Lock down remote access. Require multifactor authentication, named accounts, and logged sessions for vendor access. Turn access on when work is scheduled and off when it ends.
5. Baseline your settings. Record current setpoints, alarm thresholds, and defrost schedules for every unit. Alert on any change, especially to thresholds and defrost timing, which is exactly what attackers changed here.
6. Test your alarms, especially off-hours. Confirm temperature alarms run independently of the controller an attacker could reconfigure, and that a person answers them at 3 a.m. on a holiday or weekend. Consider lowering alert thresholds and adding on-call responders until this wave passes.
7. Rehearse the response. Decide in advance who takes a unit offline, where product moves, how known-good settings are restored, and how traffic and logs are kept for investigators. Report incidents to your national authority, such as CISA, FBI IC3, or H-ISAC in the US, ANSSI in France, or the NCSC in the UK.

Building Longer-Term Resilience

EFS got the good version of this story: monitoring worked and people acted fast. The harder lesson is ownership. Cold storage sits between facilities, operations, IT, and an outside supplier, and attackers are finding the gap.

Close it in contracts as well as on the network: patch timelines, remote access rules, incident notification within hours, and the right to audit. Then make one team responsible for knowing every connected device, who can reach it, and what normal looks like.

That is the problem Asimily is built for: an inventory of IoT, OT, IoMT, and IT devices that includes supplier-managed equipment, analysis of which exposures are exploitable, segmentation policy you can simulate before enforcing, and Configuration Control to detect setting changes and restore a known-good state.

Frequently Asked Questions

Was Any Blood Lost in the EFS Cyberattack?

No. EFS said “no health consequences have been identified, and no blood products were lost.” Monitoring and alarm systems caught the temperature changes, units were restored or taken offline, and plasma was moved as a precaution.

How Did Attackers Reach the Blood Bank Cold Rooms?

EFS says the attack hit a supplier’s systems that monitor and control its cold rooms, not EFS itself. The exact access method has not been disclosed. In the earlier supermarket attacks, French investigators said a Danfoss software vulnerability may have been involved.

Want to know which of your connected devices a supplier can reach? Request an Asimily demo.

[Related: Second Wave of Fridge Cyberattacks Hits Europe: How to Protect Your Connected Devices]