France’s blood service secures plasma after cyberattack, reports no losses

France’s national blood service says no blood products were lost and no health consequences have been identified after a cyberattack affected refrigeration controls at three facilities. Staff secured or transferred stored plasma, and blood collection and distribution continued without interruption.

In a November 3 statement, the French Blood Establishment, known as EFS, said the November 2 attack targeted its refrigeration supplier rather than the service itself. EFS collects, processes and distributes blood across France.

The attack raised temperature and defrost settings in cold-storage chambers to extremely high levels, EFS said. Its monitoring and alarms detected the changes quickly. Staff brought equipment under control or disabled it and transferred products as a precaution; the plasma was intended for transfusions and making medicines.

Supplier and security response

EFS has not named the affected supplier. Refrigeration provider Coolworld Rentals separately said an incident involving remote-monitoring software affected a limited number of its units. It said a vulnerability discussed in media reports concerned a third-party component outside its direct control. The company said it had taken measures and was supporting customers, but would not comment on individual cases.

France’s Health Ministry said remote access to the affected refrigerators had been disabled and the situation was under control. EFS said it had strengthened monitoring of its refrigeration equipment and temperatures, and that its technical teams were working with the ministry and France’s national cybersecurity agency.

Other refrigeration attacks

The incident follows attacks that disrupted refrigeration at an estimated 250 to 350 French supermarkets in October, BleepingComputer said. Attackers reportedly activated defrost functions remotely, forcing stores to discard fresh and frozen food. A further wave in November affected more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Belgian refrigeration company Sabcobel said those attacks exploited the same vulnerability as the French supermarket attacks.

Two disclosed vulnerabilities, CVE-2025-41450 and CVE-2025-41451, affect Danfoss AK-SM 8xxA refrigeration controllers. They could let attackers bypass authentication and send commands remotely, potentially giving them control of equipment. Whether either flaw was exploited in the refrigeration attacks has not been confirmed.

The Health Ministry and cybersecurity agency said an investigation is underway; they did not identify who might have been responsible.