Hackers raised temperatures at French blood storage sites, but alarms saved supplies

At three French blood storage sites, alarms went off before hackers could turn dangerously high temperature settings into ruined plasma and blood supplies.

The French Blood Establishment, known as EFS, said cold storage equipment run by external providers was compromised overnight on Monday. Attackers raised temperature and defrost thresholds to excessively high levels in units holding blood products bound for healthcare facilities, samples for EFS biobanks, and frozen plasma used in transfusions and medicine manufacturing.

What stopped it: EFS monitoring systems detected the changes quickly. Staff either brought the equipment under control or took it offline, transferring products and samples when necessary. EFS said no blood products or samples were lost, and no health impact was identified. That is the important outcome here, because blood storage does not offer much room for a software glitch with ambition.

The catch: EFS said it was not the direct target. The attack reached cold rooms operated by its contractors, part of a wider run of refrigeration hacks that had already hit supermarkets and food retailers across Europe. Those attacks remotely raised temperatures, spoiling food and, in some cases, causing fires or damaging equipment.

EFS notified France's national cybersecurity agency, ANSSI, and the Health Ministry, and increased monitoring of its equipment. The broader lesson is not especially subtle: systems that control temperatures for food, medicine and blood are physical infrastructure, even when the weak point is an internet connected controller and a bad password.

Who did it: France on Nov. 9 accused Iran's Islamic Revolutionary Guard Corps of carrying out the Oct. 11 and 12 attacks on French supermarket refrigeration systems. French prosecutors opened an investigation into Shahid Kaveh, a cyber unit linked to the IRGC, and its leadership. France has not publicly detailed the evidence behind that attribution, Iran has not officially responded, and the reporting does not establish that the blood storage incident was carried out by the same actor.

U.S. agencies issued a warning on Nov. 5 covering threats to industrial refrigeration used in healthcare, agriculture and transportation, advising organizations to update software, change passwords and disconnect unnecessary devices from the internet. The open question is whether investigators can connect the attack on EFS contractor systems to the supermarket campaign.