Hackers tried to turn blood bank fridges into ovens in chilling cyberattack

Patients needing transfusions and medicines made from donated plasma could have been affected by a cyberattack on France’s national blood service, after hackers tried to tamper with refrigeration systems at three sites.

The attempt was detected before any blood products were damaged, and the French Blood Establishment (EFS) says no supplies were lost and no health consequences have been identified. But the incident has exposed a disturbing weakness: equipment responsible for keeping vital medical products safe can be put at risk through a supplier’s computer systems.

Hackers targeted blood storage facilities

The attack took place on Monday, November 2, and targeted refrigeration equipment used at three EFS sites storing plasma. The blood service said temperature and defrosting settings had been changed to extremely high levels. The affected cold rooms normally keep products at around minus 30°C.

French media reported that hackers attempted to raise the temperature to 110°C. The EFS has not confirmed that precise figure, saying only that the settings were pushed to very high levels.

The cold rooms held bags of plasma intended for transfusions, as well as plasma used in the manufacture of medicines. Plasma is the liquid part of blood and contains proteins used in treatments for a range of serious conditions. It must be stored under carefully controlled conditions to remain suitable for medical use.

Alarms stopped the attack before products were damaged

The EFS said its monitoring and alarm systems quickly detected the abnormal settings. Staff were then able to intervene, securing the products or transferring them to other storage facilities before they were compromised.

Blood collection and distribution continued without interruption, according to the service. Hospitals and patients were therefore not left facing a disruption to supplies, and the EFS reported no loss of blood products or samples.

Attack came through refrigeration supplier

The hackers did not directly break into the EFS’s own computer network. The attack affected equipment supplied by Coolworld, a company providing refrigeration services. Coolworld acknowledged a cybersecurity incident involving a limited number of its units.

In a statement, the company said the vulnerability reported in the media related to a component supplied by a third party and was outside its direct control. It said it had responded promptly and taken appropriate measures. Coolworld did not provide further details about the affected customer or the method used by the attackers.

French authorities are investigating how the incident happened and how many refrigeration units may have been exposed. The Health Ministry said technical investigations were continuing, while remote access to the affected refrigerators was disabled.

Could similar attacks put other essential supplies at risk?

The identity of the hackers has not been disclosed, and there is no confirmed link between this incident and recent attacks on supermarket refrigeration systems elsewhere in Europe. Those attacks have caused serious disruption for retailers, with hackers remotely altering the settings of fridges and freezers. Food had to be discarded after temperatures rose, leaving businesses with substantial losses. The targeting of blood storage facilities brings the potential consequences into sharper focus: instead of spoiled groceries, a successful attack could have put medical supplies needed by hospitals at risk.

The incidents also raise questions about the security of equipment connected to the internet for remote monitoring and maintenance. A refrigeration system may appear far removed from the digital networks used to manage patient records, but it still relies on software and remote access. If those systems are compromised, the consequences can move beyond computers and into the physical world.

For now, the EFS says its blood supplies remain safe and its services are operating normally. The alarms worked, staff acted in time and no plasma was lost. Investigators still need to establish how the attackers gained access and whether other equipment could be vulnerable. The attempted attack did not cause a shortage or interrupt treatment, but it showed how quickly a cyber incident can threaten something hospitals cannot do without.