A cyberattack targeting refrigeration systems at three French blood-service facilities has prompted warnings about the security of connected cold-storage equipment used by hospitals, laboratories and other critical infrastructure operators.
Attackers remotely altered temperature and defrosting settings at facilities operated by Établissement français du sang (EFS), France’s national blood service.
- Hackers changed refrigeration and defrosting settings at three French blood-service facilities, but staff prevented blood product losses.
- Cyberattacks on commercial refrigeration systems have also affected European supermarkets, with attackers reportedly setting one Estonian store’s equipment to +50°C.
- US cybersecurity agencies and Health-ISAC warn that connected refrigeration controls pose risks to healthcare, food storage and other critical infrastructure.
Employees detected the changes through monitoring systems and transferred blood products to refrigeration units that were not connected to the compromised platform.
EFS reported no loss of blood products and no disruption to blood collection or distribution. France’s health ministry said remote access to the affected equipment had been disabled while investigators examined the incident.
The attack is part of a wider series of incidents involving refrigeration controllers at supermarkets, food-processing facilities and other organizations.
French blood banks targeted through refrigeration controls
The attack affected systems responsible for monitoring and controlling cold-storage rooms at three regional EFS facilities.
Coolworld, the refrigeration provider associated with the affected equipment, confirmed that a limited number of its units were involved in a cybersecurity incident affecting third-party remote-monitoring software.
The company said the vulnerable component came from another supplier and was outside its direct control.
Investigators have not publicly identified the attackers, confirmed how they gained access or established whether a previously disclosed software vulnerability was exploited.
The incident nevertheless exposed a potential weakness in healthcare infrastructure: refrigeration equipment can be compromised through connected control systems even when the stored medical products themselves are not directly targeted.
Blood, plasma, vaccines and other temperature-sensitive medical products require controlled storage conditions. Unauthorized changes can threaten their viability and force facilities to relocate inventory.
Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center (Health-ISAC), warned that attacks on refrigeration equipment can have direct consequences for patient safety.
“When threat actors manipulate operational technology like cold-chain storage and refrigeration units holding donor blood, plasma, or critical therapies, they aren’t merely stealing data or locking down administrative files, they are directly endangering the physical resources required to sustain human life,” Weiss told NPR.
Health-ISAC issued a security bulletin warning members about recent attacks targeting refrigeration controllers, including the French blood-service incident.
Refrigeration cyberattacks spread across Europe
The French incident follows attacks on grocery stores and food-processing operations across Europe and Israel, as well as reported refrigeration disruptions at US military bases.
Some attacks have resulted in spoiled food, damaged machinery, fires and operational interruptions. In France, hackers targeted commercial refrigeration systems used by supermarket chains Intermarché and Coopérative U.
On October 12, approximately 150-200 Intermarché locations and nearly 100 Coopérative U outlets were targeted, according to the retailers.
The attacks caused refrigeration equipment to defrost, leaving some stores with empty refrigerated food displays.
Estonian grocery stores were also targeted in November. According to Estonia’s Information Systems Authority (RIA), attackers changed the temperature setting of a refrigeration system at a Selver store to +50°C on November 2. The service provider responded before significant damage occurred.
The incidents demonstrate how access to refrigeration controllers can allow attackers to interfere directly with physical equipment and stored inventory.
US agencies warn of threats to industrial refrigeration
On November 5, the US Cybersecurity and Infrastructure Security Agency (CISA), FBI, Department of Health and Human Services, Department of Agriculture and Department of Transportation issued a joint warning about cyber threats targeting industrial refrigeration and cold-chain monitoring systems.
The agencies identified healthcare, chemical production, food and agriculture, and transportation among the sectors potentially exposed.
Industrial refrigeration equipment increasingly relies on connected monitoring platforms and remote-control functions. Vulnerabilities in those systems can provide unauthorized access to equipment responsible for maintaining critical temperatures.
FBI Cyber Branch Operations Director Brett Leatherman said authorities were monitoring malicious actors targeting refrigeration systems across critical infrastructure sectors worldwide.
Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors.
The agencies urged operators to strengthen security controls and share information about incidents to help prevent similar attacks.
Connected laboratory equipment creates additional security risks
The French blood-bank attack has implications for research laboratories, biobanks, clinical laboratories, pharmaceutical quality-control facilities and animal research operations. These organizations use refrigeration equipment to preserve specimens, cell lines, reagents, vaccines, reference materials and samples used in stability studies.
Modern laboratory freezers, refrigerators and environmental chambers often connect to institutional networks or external monitoring platforms.
Such connections allow equipment to generate temperature records, send alarms and provide vendors with remote access for maintenance.
They can also expose critical equipment to unauthorized changes if remote access is inadequately protected.
Laboratory cybersecurity assessments should therefore cover connected storage equipment alongside conventional computers, servers and information systems.
Managers need to identify which devices are network-connected, who administers them and which vendors or third parties can remotely modify operating settings.
Network segmentation, controlled vendor access and procedures for disabling remote connections can reduce exposure while preserving essential local equipment functions.
Independent alarms and backup storage reduce operational risks
The response by EFS employees demonstrated the value of functioning temperature alarms and available backup refrigeration. Staff detected the altered settings and transferred blood products before storage conditions caused losses.
Laboratories should test the complete alarm process, including whether alerts reach responsible employees and whether those employees can respond promptly.
Testing should account for nights, weekends, staff absences, network failures and outdated emergency contact information.
Facilities should also assess whether their monitoring systems operate independently of the platforms controlling refrigeration equipment.
An independent temperature-monitoring system can provide a separate warning if the primary control platform is compromised.
Backup arrangements should identify available storage capacity, priority materials, responsible personnel, transfer equipment and documentation requirements.
These measures apply to cyberattacks as well as conventional refrigeration emergencies involving power outages or mechanical failures.
