Attackers tampered with the cold-storage settings used by France’s civilian blood service after compromising a refrigeration supplier, in an incident that put frozen plasma at risk but was caught before any blood products were lost. The French Blood Establishment (EFS) confirmed the incident on Tuesday 3 November 2026.

Overnight on 1 to 2 November, the temperature and defrost thresholds of cold rooms at three EFS regional sites were changed through remote monitoring software run by the refrigeration contractor Coolworld. Rooms that normally hold frozen plasma at minus 30°C were set towards 110°C. That figure is the temperature the controls were set to request, not a temperature the rooms or their contents reached: a duty technician and EFS’s own temperature alarms caught the change, and the plasma and samples were moved to other sites.

No products lost, no patients affected

EFS says no blood products were lost, no health consequences have been identified, and blood collection and distribution continued without interruption for the roughly 1,900 hospitals and clinics it serves. The affected equipment stored blood samples and frozen plasma, including plasma intended for transfusion and plasma used to manufacture medicines. EFS said its own systems had not been directly targeted, and notified the country’s cybersecurity agency, ANSSI, and the Ministry of Health.

The incident is part of a wider run of attacks on internet-connected refrigeration controllers. About 700 French supermarkets were hit on the night of 11 to 12 October, and more than 100 shops in nine other European countries were affected on 2 November, according to reports. France’s CERT-FR published an advisory in October urging organisations to fix vulnerabilities in Danfoss AK-SM and AK-SC controllers. No group has claimed the blood service attack.

Sources: The Register, Cyberattack on French plasma stores is enough to make your blood boil, 4 November 2026; SecurityWeek, Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised, 5 November 2026.