Hackers Tried to Heat French Blood Bank Freezers Past Boiling Point

Cybercriminals attempted to manipulate the temperature settings of blood-storage freezers in France. Refrigeration settings were altered from around "-30 degrees Celsius" to as high as "110 degrees Celsius", endangering plasma supplies used for medicine production and transfusions.

Overnight, between November 1 and 2, the cyberattack disrupted three facilities belonging to the French Blood Establishment (EFS). Instead of directly targeting the blood service, cybercriminals tampered with refrigeration systems provided by an external supplier.

While this attack on the French blood banks occurred, hackers also attacked supermarkets across Europe from Sweden to Belgium. However, it’s not yet known if the same hackers were responsible for it. 

According to an EFS spokesperson, Charley Dubois, the blood supply was not impacted during the hack. However, the cold rooms storing blood were affected by hackers. The cybercriminals aimed to increase the temperatures; however, the staff got there in time to prevent any damage to the blood supplies. 

“We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected,” she added, according to a Reuters report. 

With investigations underway, it has been discovered that anomalous changes were made 

Monitoring and alarm systems detected the changes before any plasma or samples were lost, but the incident has raised concerns about the cybersecurity of connected healthcare infrastructure and the risks posed by third-party suppliers.

In an official statement, EFS said its monitoring and alarm systems quickly detected the anomalies, which allowed staff to act so that no blood products or samples were compromised. 

The blood bank cybersecurity incident follows the recent attacks on European supermarkets. It has raised further concerns about the security of healthcare IT infrastructure and the cybersecurity risks posed by third-party technology suppliers.

What Happened in the French Blood Bank Cyberattack?

Three regional EFS sites’ refrigeration monitoring and control systems were targeted by cybercriminals. These facilities preserve plasma supplies for transfusions and the manufacture of pharmaceutical medicines, as well as other biological materials.

French newspaper Le Canard Enchaîné reported that cybercriminals attempted to modify refrigeration settings from around "-30 degrees Celsius" to "110 degrees Celsius". They attempted to change the temperature from a deep freeze to over the boiling point. 

Hypothetically, if a refrigerator’s cooling system heated up to 110 degrees Celsius, the extreme pressure would burst the pipes and vent chemical gases. The intense heat could permanently melt and destroy the compressor motor. Additionally, modern units could pose a serious fire or explosion hazard because of flammable refrigerants. 

The reported "110 degrees Celsius" figure refers to the target temperature setting without confirming that the storage reached this temperature. EFS said the “temperature and defrosting thresholds” had been “raised to extremely high levels.”

The institution's alarm and monitoring systems discovered the unusual changes, allowing employees to act before any blood products were affected.

EFS also stated that “no health consequences have been identified, and no blood products were lost.” Plasma that was initially impacted was relocated or secured, while blood collection and distribution continue without disruptions.

How Did Hackers Target French Blood Storage Systems?

The cyber incident hit refrigeration systems provided by Coolworld, a supplier of industrial cooling equipment and remote monitoring services.

Coolworld confirmed a cybersecurity incident affecting a small number of its refrigeration equipment.

In an official statement, as reported by BleepingComputer, the company said: “The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld’s direct control.”

The company further added that it had “responded promptly” and taken “appropriate measures.” Though, the exact methods used to gain access to the disrupted systems have not been publicly disclosed.

Healthcare institutions rely more on external suppliers to maintain their systems and manage remote monitoring equipment. Vulnerabilities in third-party software and components can create gateways for cyberattacks.

Why Are Refrigeration Systems Vulnerable to Cyberattacks?

The cyberattack also raises concerns about the cybersecurity challenges associated with operational technology (OT), where digital systems connect to processes and physical equipment.

Unlike traditional IT systems, OT can directly influence physical environments. In this incident, disruptions to refrigeration settings put blood-storage conditions at risk.

On Thursday, Cybersecurity Dive reported that the National Cybersecurity Agency of France, ANSSI, was “investigating” the wider refrigeration attacks and “coordinating” safeguarding measures across possibly targeted institutions.

The cyberthreat also sparked a warning from US authorities. Reuters reported that the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and other government departments had issued a joint alert about cybercriminals targeting industrial refrigeration and temperature-controlled systems.

Chris Butera, CISA’s acting executive director of cybersecurity, warned, “Every organisation that depends on refrigeration and monitoring systems should assume it could be a target.”

An ANSSI spokesperson told Cybersecurity Dive: “Since the mid-October incidents, ANSSI is conducting investigations and ensuring the coordinated implementation of preventive and remediation measures, alongside every industry which might be impacted by this incident."

The agency also confirmed that it was “aware of compromises involving Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb controllers.” Thousands of devices allegedly remain exposed on the internet.

However, there is currently no confirmation that these controllers were used in the cyberattack on EFS.

This incident comes amid separate cyberattacks targeting supermarket refrigeration systems across Europe. In those attacks, cooling equipment was also affected, resulting in food losses.

Despite the similarities between the incidents, authorities have not yet established whether the same cybercriminals carried them out.

Third-Party Vulnerabilities Put Healthcare Systems at Risk

Healthcare institutions increasingly depend on providers to maintain connected systems, deliver remote monitoring, and support critical infrastructure. However, this dependence can create additional weaknesses when external systems are compromised.

The EFS cyberattack emphasised the importance of monitoring and response capabilities. Its alarm systems identified unusual changes, allowing employees to protect stored plasma and prevent any products from being damaged.

Meanwhile, ANSSI’s investigation and coordination with targeted organisations underline the wider implications of safeguarding linked refrigeration systems.

As healthcare facilities become more reliant on connected refrigeration systems, institutions should extend their focus beyond their internal networks and consider the cybersecurity of the technologies and providers they trust.