French Blood Banks Survive Cyberattack That Targeted Plasma Freezers

French authorities reported that a cyberattack attempted to spike the temperatures of plasma storage units at three sites of the French Blood Establishment, known as EFS. The incident occurred on Monday, though details were confirmed in a statement released late Tuesday. Attackers tried to increase temperature and defrosting thresholds to extreme levels, but monitoring systems detected the change quickly. Staff intervened before the heat could damage the inventory.

According to the weekly newspaper Le Canard Enchaîné, which first reported the breach, the attack sought to reset temperatures normally set at minus 22 degrees Fahrenheit to as high as 230 degrees Fahrenheit. The EFS stated that the affected products included bags of plasma intended for transfusions and plasma used in medicine manufacturing. These items were either transferred or secured immediately after the alert was triggered.

The EFS confirmed that no blood products or samples were compromised and that no health consequences have been identified. Blood collection and distribution operations remain uninterrupted, ensuring continued service for hospitals and other healthcare facilities. The agency noted that no blood products were lost during the incident.

The refrigeration equipment at the three EFS sites was supplied by Coolworld. The company stated it is aware of the cybersecurity incident and noted that the vulnerability relates to a component from a third-party supplier outside its direct control. Coolworld said only a limited number of units were affected and that it is taking appropriate measures to address the issue.

France's national cybersecurity agency and the Health Ministry are currently investigating the incident. The ministry has not indicated who might be behind the attack. This event mirrors a mid-October episode that targeted fridges and freezers at hundreds of supermarkets and independent stores across France, Belgium, and the Netherlands. In that earlier incident, remote takeover caused freezers to warm up, spoiling tons of food and resulting in millions of dollars in costs.

Dutch supermarket chain Ahold Delhaize, one of the retailers hit in October, announced on Wednesday that the cyberattack is expected to reduce its fourth-quarter sales by as much as 281 million dollars, or 250 million euros. The company also projected a decrease in operating income for the period of over 112 million dollars, or about 100 million euros. CEO Franz Muller stated that while most disruption was contained within two weeks, work continues to fully restore normal operations.

Muller noted that cyber threats are an increasingly harsh reality of doing business today. The company had earlier attributed the issues to malicious actions by others. It proactively took some systems offline, including websites and apps for its various brands in Europe and the United States, to mitigate further impact.