A cyberattack on a contractor-linked refrigeration system affected three facilities of France's national blood service, Établissement français du sang (EFS), during the night of November 1–2. Reports said remote settings were manipulated to target temperatures as high as 110°C. That extraordinary figure describes a command entered into the equipment's control system—not an independently recorded temperature inside the storage units. Staff and alarms detected the anomaly, and the blood service and health authorities reported no lost blood products or interruption of essential blood operations.
What happened overnight
France's health ministry confirmed that monitoring and control systems associated with cold-storage rooms at several regional EFS facilities were affected by a cybersecurity incident. Reuters and Associated Press identified three sites. French technology reporting traced the access path to Coolworld, a refrigeration-services contractor, although the precise exploitable component and intruder remain under investigation.
The initial press accounts referred to donor samples. EFS and subsequent coverage also specify plasma for transfusion or medicine manufacturing among the products involved. Those are distinct types of material and should not be blurred into a statement that all of France's blood inventory was exposed.
Sources: French blood banks hit alongside cyberattack on European supermarkets (Reuters wire) · Cyberattack hits French blood bank site but no blood products are compromised · L’Établissement français du sang touché par le piratage de certaines chambres froides · Cyberattack hits French blood banks but no samples compromised, officials say
Why 110°C is not a recorded freezer temperature
The French weekly Le Canard enchaîné, as summarized by Next and other French outlets, reported that some equipment normally set around minus 30°C was remotely reprogrammed toward 110°C. This was the control setpoint or defrost threshold, not evidence that physical stores actually reached boiling-water temperatures. Reports did not establish a complete measured temperature curve for each chamber.
A remote control value can be dangerous even if the equipment cannot reach the requested extreme. The risk lies in a loss of reliable control, a delay in detection and a possible break in the required cold chain. In this case the alarm and human response appear to have prevented reported product damage.
Sources: L’Établissement français du sang touché par le piratage de certaines chambres froides · Cyberattack hits French blood banks but no samples compromised, officials say · After supermarket freezer hacks, France’s blood storage systems are targeted
What French health authorities confirmed
EFS said alerting systems detected unusual settings and staff either secured affected material or moved it to other cold storage. Its statement reported no compromised products or samples, no identified health consequences and no interruption of donation or distribution. Reuters separately quoted an EFS spokesperson explaining that overnight staffing allowed a rapid response.
By November 4, the health ministry said the situation was under control and remote access had been disabled for the affected refrigeration equipment. That is a mitigation step, not proof that every forensic question or the broader investigation has been resolved.
Sources: French blood banks hit alongside cyberattack on European supermarkets (Reuters wire) · Cyberattack hits French blood bank site but no blood products are compromised · Cyberattack hits French blood banks but no samples compromised, officials say
A supplier connection becomes a critical boundary
The intrusion highlights an operational risk of remote maintenance: an outside support channel can become a route into equipment whose contents are medically sensitive. The available reporting does not identify a confirmed attacker, a proven initial exploit, or a complete chain of commands. Assigning the attack to a particular country or group would go beyond the public evidence.
It also does not show that patient data or donor identities were stolen. A control-system intrusion and a privacy breach are different claims requiring different evidence. The case illustrates why local alarms, operator staffing and a way to isolate remote connections can matter even when network controls fail.
Sources: French blood banks hit alongside cyberattack on European supermarkets (Reuters wire) · Cyberattack hits French blood bank site but no blood products are compromised · Cyberattack hits French blood banks but no samples compromised, officials say
Different from the supermarket refrigeration attacks
French and European retailers were experiencing separate refrigeration cyber incidents at roughly the same time, and Reuters described related patterns of remote tampering. That temporal proximity does not prove the incidents had the same attackers or an identical vulnerability. The separate report, 'Europe’s Freezer Cyberattacks Reach UK Food Suppliers, Exposing a Cold-Chain Weak Point,' concerns different facilities and consequences.
The blood-service incident is therefore a separate healthcare-infrastructure story, not a republication of the supermarket loss report. The two incidents can be compared to ask how temperature monitoring, local intervention and connectivity isolation affect the outcome when equipment controls are targeted.
Sources: French blood banks hit alongside cyberattack on European supermarkets (Reuters wire) · Cyberattack hits French blood bank site but no blood products are compromised · After supermarket freezer hacks, France’s blood storage systems are targeted
What remains unknown
Investigators still need to establish the full attack path, the number and configuration of affected devices and when normal remote services can safely resume. The public record cited here does not verify the attacker's identity or whether the same actor targeted supermarkets.
As of November 5, the most important distinction is that a serious attempted change to refrigeration settings was detected without reported harm to the stored blood products. The 110°C setting is newsworthy precisely because it reveals the intended disruption; it must not be reported as a measured storage temperature.
Sources: French blood banks hit alongside cyberattack on European supermarkets (Reuters wire) · Cyberattack hits French blood bank site but no blood products are compromised · L’Établissement français du sang touché par le piratage de certaines chambres froides · Cyberattack hits French blood banks but no samples compromised, officials say
