Hackers force temperatures up in French blood bank cold storage

A cyberattack forced temperatures to rise in cold-storage rooms at three sites of the French Blood Establishment (EFS), the country's public blood service, after hackers targeted one of its refrigeration equipment suppliers, the EFS said in a 3 November statement. Monitoring and alarm systems caught the anomalies quickly enough that no blood products or samples were compromised, and stocks — including plasma needed for transfusion — were transferred to other facilities as a precaution. Patient service was not interrupted. France's cybersecurity agency ANSSI and the health ministry are investigating.

The incident follows a wave of similar attacks on the least glamorous infrastructure in Europe. On 2 November, supermarket chains across Belgium, Luxembourg, Sweden, Italy and Germany reported hacks that forced store refrigerators and freezers to 122 degrees Fahrenheit, forcing stores to throw away food. Carrefour had 80 franchised stores hit last month and 15 more in Belgium on Monday. In October, hackers remotely took control of refrigeration systems in hundreds of French supermarkets and independent stores.

The pattern is consistent: networked climate controllers, installed for remote maintenance and cost savings, become a lever anyone on the internet can pull. Frank Groenewegen, a cybersecurity expert at Deloitte in The Hague, says retailers should check whether their fridge and freezer controllers are vulnerable and patched — and if they don't even know, 'remove them from the public internet immediately'. Disconnecting doesn't fix the root cause, he notes, but it isolates the systems so attackers cannot reach them.

The supermarket sector has a structural weakness: many European stores operate as independent owners in cooperative structures, so systems differ even within the same brand, and updates arrive unevenly. Healthcare logistics offer a softer target still — a blood bank fridge has no explosion, no headline, just a silent number drifting upward on a sensor that nobody in the boardroom has budgeted to defend.

The EFS stressed that it was not the target — its supplier was. That is precisely the problem: the attack surface now includes every contractor with a login.