Rapid News Brief
France’s blood service disclosed Nov. 3 that a cyber incident at a refrigeration-equipment supplier altered controls at three of its sites, prompting staff to secure or relocate blood products and samples.
The Établissement français du sang, known as EFS, said the supplier was affected Nov. 2. EFS said it was not directly targeted and reported no blood-product losses or interruption to collection and distribution.
Alarms enabled intervention
The incident changed temperature and defrosting thresholds to very high settings, EFS said in its public statement. It did not disclose the temperatures actually reached by the stored materials.
EFS said its monitoring and alarm systems quickly identified anomalies. Staff regained control of affected equipment or took it out of service, with stored materials either secured or moved preventively to other facilities.
The materials included plasma intended for transfusions and for manufacturing medicines. EFS said it had increased equipment monitoring and was working with France’s national cybersecurity agency, ANSSI, and the Health Ministry.
The Associated Press reported Nov. 4 that the intervention prevented damage to blood products and samples, citing French authorities.
Earlier warning covered refrigeration controls
France’s government computer-security response team, CERT-FR, issued a refrigeration-controller alert Oct. 12 and updated it Oct. 16. It documented compromises involving certain Danfoss, Copeland and Dixell controllers.
The advisory recommended removing management interfaces from the public internet, checking equipment configurations, including defrost settings, and restricting remote access to a secured virtual private network or protected network.
CERT-FR also warned that a factory reset alone leaves unpatched, internet-exposed equipment vulnerable to renewed compromise. Its guidance for Danfoss equipment included firmware updates, strict security settings and changing default passwords.
That alert provides broader security context, not proof of how the EFS supplier was compromised. The blood service’s statement did not identify the supplier, equipment models, attacker or access method.
For organizations relying on temperature-controlled storage, the incident highlights an operating dependency beyond conventional business software: Supplier-managed equipment can affect physical inventory.