A new cyberattack has struck France, this time taking direct aim at the country’s blood reserves. Overnight between Sunday, November 1 and Monday, November 2, hackers attempted to breach the remote temperature-control systems at three sites run by the French Blood Service (Établissement français du sang, EFS), with a goal as simple as it was alarming: push the temperature of cold storage rooms from minus 30 degrees Celsius up to 110 degrees.
Such a swing would, within hours, have destroyed the entire stock of blood bags and plasma held in those units, reserves that hospitals rely on for emergency transfusions. It was an independent alarm system, running separately from the hijacked remote controls, that caught the anomaly in time. EFS technical teams moved quickly, securing the most exposed batches and shifting part of the stock to other facilities as a precaution.
In a statement, EFS said no blood bags were lost and that the incident had no impact on patients’ health. Blood collection and distribution to hospitals continued without interruption, the agency said, though it has stayed tight-lipped about which sites were targeted or what leads investigators are pursuing.
This is not an isolated case. The attack comes just weeks after a similar assault, overnight between October 11 and 12, that hit the refrigeration systems of roughly 700 large retail stores across France. In that earlier incident, attackers remotely altered the settings of refrigerators and freezers, pushing some units to 50 degrees and others as high as 80, destroying tons of food.
The shared method behind both attacks, targeting infrastructure managed through remote industrial control systems, points to a common weak spot in the supervisory software used by many of France’s critical operators. Neither the exploited vulnerability nor the identity of the attackers has been made public so far, but the episode has reignited concerns over the cybersecurity of sensitive public-health infrastructure, at a time when hospitals and medical facilities increasingly rely on connected equipment for day-to-day operations. Health authorities have not said whether a formal complaint has been filed.
