Cyberattack Targets French Blood Service Refrigeration Systems
Attackers remotely manipulated cold-storage settings, threatening critical blood and plasma supplies across France.
1Targeting Critical Infrastructure
The French Blood Establishment confirmed that attackers compromised a third-party refrigeration supplier to manipulate cold-storage settings. While the organization's internal systems remained secure, the breach targeted equipment housing blood samples and frozen plasma. This incident highlights the growing vulnerability of critical healthcare infrastructure to remote cyber interference via supply chain weaknesses.
2Rapid Incident Response
EFS monitoring and alarm systems successfully identified temperature anomalies immediately after the breach occurred. Staff neutralized affected equipment or transferred stored products to secure facilities to prevent spoilage. These safeguards ensured that no blood products were compromised, maintaining the integrity of the transfusion supply despite the malicious remote tampering attempts.
3Temperature Manipulation Tactics
Reports indicate that attackers attempted to alter cold-room settings from -30°C to 110°C. Although the equipment did not reach these extreme temperatures, the intent to cause massive product loss is clear. EFS has notified the national cybersecurity agency, ANSSI, and the Ministry of Health to investigate the breach and prevent future occurrences.
4Widespread European Disruptions
This attack is part of a broader wave of cyber incidents targeting refrigeration devices across Europe. Retailers in countries including Belgium, Ireland, Luxembourg, and Sweden reported spoiled food after attackers activated defrost modes. The disruption has expanded to Estonia, Finland, Germany, Portugal, Romania, and the Netherlands, signaling a coordinated campaign against cold-chain infrastructure.
5Supply Chain Vulnerabilities
The UK's National Cyber Security Centre acknowledged impacts within the British food supply chain. The British Association of Independent Meat Suppliers reported that some of its 300 members suffered collateral damage, with multiple businesses experiencing forced defrosting. These incidents underscore the systemic risks posed by interconnected industrial control systems used in diverse sectors.
6Recurring Supermarket Attacks
This event follows a previous wave of attacks targeting French supermarket chains like Carrefour, Intermarché, and Monoprix. Those incidents also involved remote interference with refrigeration controls, resulting in significant stock losses. While the specific access route for the EFS attack remains under investigation, the pattern mirrors these earlier, highly disruptive retail sector breaches.
7Technical Advisory and Equipment
CERT-FR previously issued an advisory urging organizations to remediate vulnerabilities in Danfoss AK-SM and AK-SC controllers. While some affected chains identified Danfoss equipment, others reported different hardware, complicating the attribution process. The lack of a single common denominator suggests attackers may be exploiting multiple entry points within the global refrigeration supply chain.
8Broader Security Implications
The escalation from retail food spoilage to targeting civilian blood services marks a significant shift in threat actor behavior. By weaponizing industrial refrigeration controls, attackers create tangible physical consequences without needing direct access to core networks. Organizations must prioritize securing remote management interfaces to prevent further exploitation of these critical operational technology assets.