Cyberattacks disrupted temperature management systems at three facilities belonging to the Établissement Français du Sang (EFS) this week, marking the first known incident to strike a healthcare organisation in the current wave of attacks targeting refrigeration infrastructure across Europe.
The EFS stated in a Tuesday announcement that "no health impacts have been identified and no losses of blood products have been reported." The organisation explained that "temperature and defrosting thresholds were raised to very high levels" in cold storage areas where blood products undergo preparation and distribution before reaching hospitals, as well as where biobank samples are maintained.
A representative speaking to Recorded Future News confirmed that three EFS locations experienced the breach but declined to specify which facilities were affected or provide details about the refrigeration control system manufacturer and model involved.
According to the EFS, "The EFS's monitoring and alarm systems enabled the rapid identification of these anomalies and the implementation of necessary measures to ensure that no blood samples or products were compromised." The organisation noted that "depending on the circumstances, as soon as the incident occurred, the affected equipment was either brought under control without impacting the products and samples, or neutralized; the products stored in these cold rooms were preventively transferred to other facilities."
The EFS was not directly targeted but rather compromised through a third-party supplier of refrigeration equipment, similar to the pattern seen with other affected retailers across the continent.
The incident represents the first documented French case in the current attack sequence and the first to affect healthcare infrastructure. Organisations in at least 11 countries have reported being compromised: Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom.
This latest campaign follows an earlier wave in October that struck France, during which unknown attackers remotely triggered refrigerator defrosting cycles that led to food spoilage. Whether the same actors orchestrated both campaigns remains unclear, and no group has publicly claimed responsibility for either series of attacks.
After the United Kingdom confirmed on Tuesday that its companies had also been targeted, British authorities stated they have not assigned the incidents to any particular group. A representative from Belgium's cybersecurity agency told Recorded Future News that "it may never be possible to identify" the perpetrators.
