Hackers tried to manipulate refrigeration systems protecting blood plasma at three French medical facilities, potentially putting critical medical supplies at risk.
The cyberattack targeted equipment operated by the French Blood Establishment (EFS) between Nov. 1 and 2. Attackers reportedly gained access through a third-party refrigeration provider and changed temperature and defrosting settings, but monitoring systems detected the abnormal activity before stored products were damaged.
The incident follows reports of other refrigeration-related cyber incidents in Europe and highlights the risks of relying on external vendors to maintain connected operational technology. Investigators have not established whether the attacks are related.
How the attack unfolded
The attack took place between Nov. 1 and 2, when hackers compromised a refrigeration service provider connected to the EFS. Through the supplier's systems, they accessed refrigeration equipment at three EFS facilities storing plasma and biological samples.
The attackers manipulated temperature and defrosting thresholds, attempting to expose the stored products to dangerously high temperatures.
CBS News, citing French newspaper Le Canard Enchaîné, reported that settings were changed from approximately -30°C to 110°C. The figure refers to the reported configuration change, not a confirmed temperature reached by the stored products.
EFS's monitoring and alarm systems detected the abnormal changes, allowing staff to intervene before any products were damaged. Staff secured the affected equipment and transferred stored plasma to other facilities as a precaution.
DW-TV reported that remote access to the affected refrigerators was subsequently disabled. Coolworld, the refrigeration supplier identified in reports, acknowledged a cybersecurity incident involving its software and attributed the reported vulnerability to a third-party component.
EFS says that the investigation into the incident is ongoing.
Follows a wider wave of attacks on refrigeration systems
The incident follows reports of other refrigeration system disruptions in France and elsewhere, although investigators have not established that the cases are connected.
In October, hackers disrupted refrigeration equipment at hundreds of French supermarkets, manipulating temperature and defrosting settings and causing widespread food losses.
Separately, the Pentagon is investigating freezer failures at at least six US military bases that happened in August, but recently became widespread knowledge following the first French attacks. The Pentagon is investigating whether refrigeration failures at several US military facilities were caused by a cyberattack. A cyber-related cause has not been confirmed.
A second wave of attacks affected supermarkets and businesses across several European countries, including Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Per The Guardian, hundreds of stores and businesses were reportedly affected overnight between Nov. 1 and 2, the same period as the attack on EFS facilities.
The French blood bank attack offers a lesson in cyber resilience
The incident illustrates how cybersecurity defenses can limit physical damage even after attackers gain access to connected equipment.
"We can't prevent every intrusion, particularly with complex third-party dependencies, but effective monitoring, physical safeguards, and response procedures can prevent a technical compromise from becoming something much more consequential," Gabrielle Hempel, security operations strategist at Exabeam, told eSecurity Planet.
Darin Fredde, senior director of technical marketing engineering at Ridge Security, said the attack reflects a broader shift in the consequences of third-party security failures. Rather than appearing only as stolen data or disrupted servers, those failures can affect the physical systems that organizations depend on.
EFS's monitoring and alarm systems reportedly detected the abnormal refrigeration settings, allowing personnel to intervene before stored plasma was damaged. The response underscores the importance of independent monitoring, rapid escalation procedures, and safeguards that remain effective when remote management systems are compromised.
If you have a connected freezer at work or home, here's what you can do
Internet-connected refrigeration equipment can introduce security risks, particularly when its control systems are accessible remotely.
According to Damon Small, a board member at Xcape, Inc., “any device capable of affecting human safety that is connected to the internet must have strong authentication and access controls. Access should be restricted to authorized users through appropriate filtering, because these systems deserve the same level of protection as any other critical operational technology.”
For individuals and enterprises that use connected freezers:
- Avoid public internet exposure: Do not expose refrigeration controllers directly to the internet through public IP addresses.
- Secure remote access: Use a protected VPN for remote maintenance instead of unrestricted internet access.
- Change default passwords: Replace factory-set credentials on refrigeration controllers and secure associated appliance accounts with unique passwords.
- Update controller firmware: Install security patches from equipment manufacturers and replace unsupported controllers when needed.
- Monitor temperature settings: Enable alerts for unexpected temperature changes, where possible.
- Isolate critical equipment: Businesses should keep operational controllers on dedicated network segments, separate from ordinary office computers.
The EFS incident shows why protecting connected refrigeration equipment requires more than securing the devices themselves. Organizations also need to control vendor access, monitor equipment independently, and maintain response procedures that can prevent a compromised system from damaging temperature-sensitive supplies.
For healthcare providers, food distributors, and other operators of critical refrigeration systems, the priority is ensuring that a cyberattack cannot silently turn a remote configuration change into a physical safety incident.
In other news, Harvard University's 2025 data breach exposed approximately 851,000 unique email addresses, according to a new Have I Been Pwned listing, with compromised alumni and donor information potentially enabling targeted phishing and impersonation attacks.