Cyberattack on EFS refrigeration affected three French blood service sites
An attack through a refrigeration equipment supplier changed device settings at three EFS sites. According to the service, blood products and samples were not damaged.
A cyberattack on EFS refrigeration affected three sites of France’s Établissement français du sang (EFS) blood service. The incident came through a refrigeration equipment supplier, not through a direct attack on EFS systems. The service said its monitoring and alarm mechanisms quickly detected the anomalies and that no blood products or samples were damaged.
At the affected locations, temperature and defrost limits on refrigeration equipment were raised to very high levels on Monday. EFS subsequently secured the contents of the equipment or moved them as a precaution. Blood collection and distribution continue without any reported disruption to patient supplies.
Cyberattack on EFS refrigeration changed operating limits
According to a public statement by EFS, the incident affected the settings of refrigeration equipment used in its operations. The organization did not identify the supplier, specify which equipment models were affected, or say which specific vulnerability or intrusion method allowed the attacker to access the systems.
The immediate measure confirmed was disconnecting or neutralizing the affected equipment and securing its contents. EFS said that anomaly detection prevented damage to plasma, other blood products, or laboratory samples.
Some unofficial reports cited a temperature setting as high as 110 °C. However, EFS did not confirm this specific figure in the publicly cited statement. The available information therefore indicates only that the limits were raised to very high levels.
ANSSI and the health ministry are leading the investigation
The case is being investigated by France’s cybersecurity agency ANSSI together with the health ministry. The perpetrator, the extent of the supplier’s compromise, and whether a fix or security advisory is already available for operators of comparable equipment are not publicly known.
Any possible connection to recent attacks on refrigeration systems in European retail has also not been confirmed. Although the incident involved remotely managed refrigeration, the available data do not make it possible to determine whether the attack used the same method or was carried out by the same actor.
Physical impact with no confirmed losses
The case is among cyber incidents with a direct physical impact on operational equipment. Refrigeration equipment is part of the critical logistics chain for processing and storing blood products. In this case, according to EFS, protection and alarm systems prevented confirmed damage to products and samples.
Further findings should clarify the attack vector, the supplier’s identity, the number and type of affected devices, and any recommendations for other operators. It will also be important to see whether ANSSI or the health ministry issues a security advisory, or whether EFS later changes its assessment of the incident’s impact.
Sources
- Associated Press – Quotes an EFS statement saying that three sites were affected through a refrigeration supplier, products and samples were not damaged, and the case is being investigated by ANSSI and the health ministry.
- The Record – Reports that EFS was not the direct target, the incident came through an external supplier, and products were secured or moved as a precaution.
- RTL – Provides a statement from an EFS representative about the rapid detection of anomalies, equipment disconnection, and zero losses of products or samples.
Verified and updated: 04. 11. 2026 15:20
