Cyberattack on EFS plasma freezers in France: no blood products lost

A contractor that provides refrigeration equipment to the French Blood Establishment (Établissement français du sang, EFS) was targeted in a cyberattack on the night of Sunday to Monday, November 1–2, 2026. Attackers remotely changed the settings of some freezers at 3 EFS sites, where frozen plasma was stored. According to the EFS statement of November 3, the alarms quickly flagged the anomalies; no blood products were lost and no impact on patients’ health was identified.

What is known

EFS, France’s public blood service, says it was not directly targeted. The incident affected a “refrigeration equipment contractor”, and “the monitoring and control systems for the freezers” at 3 of the institution’s sites were compromised. “Specifically, the temperature and defrost thresholds were raised to very high temperatures,” the statement says.

The affected freezers contained bags of plasma intended for transfusions and bags of plasma intended for fractionation, that is, the manufacture of medicines. “No health impact has been identified and there are no blood product losses to report,” EFS said. Depending on the case, the equipment was either brought back under control or taken out of service, and the products were moved preventively to other facilities. The institution says the continuity of blood collection and distribution is guaranteed.

The office of Health Minister Stéphanie Rist confirmed the incident to AFP, as reported by Sud Ouest: “The safety of stocks was maintained thanks to the facilities’ monitoring and alarm systems, as well as precautionary measures put in place immediately.” According to the ministry, these measures include blocking remote access to the affected equipment and intensifying monitoring of storage conditions.

EFS President Frédéric Pacoud told BFMTV, according to Numerama, that “the safety of the products was never compromised”, but acknowledged the risk: “We could have lost samples or bags of plasma intended for treating patients.”

What has not been officially confirmed

The case was revealed on Tuesday, November 3, by the weekly Le Canard enchaîné. The publication says the contractor is Coolworld, which maintains EFS storage containers, “especially in Bourgogne-Franche-Comté”, and that the freezers, kept at -30 °C, were reportedly programmed to reach 110 °C. EFS has not named the contractor or specified which sites were affected. The figure of 110 °C does not appear in the institution’s statement, which refers only to “very high temperatures”. According to Euronews, EFS said that this temperature was never reached.

No one has claimed responsibility for the attack, and the authorities have not attributed the incident to any group or state. There is also no official confirmation that the same attackers were behind the attacks on supermarket refrigerators. The type of equipment used in the EFS freezers has not been made public either.

Investigation

EFS is working with the French National Agency for the Security of Information Systems (ANSSI) and the Ministry of Health. According to the minister’s office, cited by BFMTV, technical investigations are continuing to determine the method of operation, the total number of potentially affected units of equipment and the timeline for bringing them back into service. The ministry has announced that it will provide an updated assessment once the technical data has been consolidated.

As of publication, we have found no communication from the French prosecutor’s office or police about a criminal investigation into the EFS case. In the wave of attacks on supermarkets in October, the cybercrime division of the Paris prosecutor’s office opened an investigation on October 12 and handed it to the Office for the Fight against Cybercrime (OFAC), according to RMC.

Why temperature matters

Each component of blood has its own storage conditions. According to EFS, red blood cells can be stored for up to 42 days at around 4 °C, platelets for up to 7 days at 22 °C, while plasma can be frozen. Plasma is usually frozen at -30 °C, EFS says.

The attack did not target EFS’s ordinary IT network, but operational technology systems: controllers that directly operate physical equipment and can be managed remotely by suppliers.

Wave of attacks on refrigeration systems

On the night of October 11–12, hundreds of supermarkets in France were affected by attacks on refrigeration systems. Between 150 and 200 Intermarché stores, fewer than 100 Coopérative U stores and Leclerc stores were affected, according to RMC. France’s Computer Emergency Response Team, CERT-FR, issued an alert on October 12, updated in the following days, about “numerous compromises” of Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB remote controllers. CERT-FR, which operates within ANSSI, asked operators to remove these interfaces’ exposure to the internet and check defrost programs.

A new wave followed on November 2, with incidents in Belgium, Sweden, the Netherlands, Luxembourg, Ireland and Estonia. Romania’s National Directorate for Cyber Security reported abnormal temperature increases at 6 stores belonging to a single retail chain, according to AGERPRES.

French hospitals frequent targets

ANSSI was informed in 2022–2023 of 30 healthcare facilities compromised and encrypted with ransomware, accounting for 10% of incidents of this type reported to the agency. The share of healthcare incidents among all cases handled by ANSSI rose from 2.87% in 2020 to 11.4% in 2023, according to the Digital Health Agency. In 2022, an attack on the hospital in Corbeil-Essonnes led to newborns being transferred from the neonatal ward, while hospitals in Armentières and Cannes were hit in 2024.

The EFS statement says the institution has strengthened monitoring of the operation and temperatures of all its equipment.