Cyberattack hits blood-product storage sites in France; no products damaged, authorities say

A cyberattack affected blood-product storage sites in France on or around Monday, 2 November. The Guardian, Le Monde and Reuters all report that no blood products were damaged or compromised. The attack involved efforts to raise temperatures to very high levels.

France's blood service, EFS, said hackers accessed control systems at three cold stores, according to The Guardian. EFS said temperature and defrosting thresholds were raised, and that its alarm systems allowed technicians to intervene before the products were compromised.

EFS said products in the affected rooms were moved to other sites. They included plasma bags for transfusions and medicine manufacturing. EFS also said France's national cybersecurity agency, ANSSI, and the health ministry had been alerted, and that monitoring of all its equipment had been reinforced. According to The Guardian, EFS distributes products to more than 1,900 hospitals and supports more than a million patients a year.

Wider incidents

The Guardian reported that temperatures in supermarket refrigerators and freezers in almost a dozen European countries rose as high as 50C (122F), causing millions of euros of food damage. Retailers in Italy, Germany, Romania and the UK were targeted on Tuesday, it said. Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden had reported refrigeration problems the previous day.

The Guardian also reported that hackers seized control of cooling units in as many as 700 French supermarkets last month. Italy's government held emergency talks with intelligence officials on Tuesday, it said.

In the United States, fridge malfunctions hit commissaries at at least six military bases in early August, according to The Guardian. The Pentagon is investigating a suspected hack. The Guardian says something similar to the European attacks may have happened there.

The Guardian reported that no motive is known and that no one has claimed responsibility. The reports do not establish whether the blood-storage attack is technically linked to the supermarket incidents. They also do not say how the attackers gained access, what temperatures were reached, or whether supplies to hospitals or patients were affected.

What is disputed

Accounts differ on what was hit. Reuters, citing the health ministry, reported that several regional blood banks or centres were affected. EFS said it was not directly targeted and that the attacks hit cold stores run by its contractors, according to The Guardian.

Accounts also differ on the temperatures. According to The Guardian, EFS said hackers boosted temperatures, with thresholds raised to "very high levels". Le Monde reported an attempt to raise temperatures to extremely high levels.

What each side says

The Guardian quoted EU spokesperson Thomas Regnier as saying: "These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents". He said EU agencies were holding urgent discussions with national authorities, and he declined to name any potential culprits.

Rafe Pilling, senior director for threat intelligence at Sophos, told the Guardian the most plausible scenarios were "state-based signalling and demonstration of capability" or a lone-wolf hacker.

According to The Guardian, some authorities and experts fear government-sponsored hybrid attacks in the aftermath of Russia's 2022 invasion of Ukraine. Western intelligence officials say Moscow is waging a campaign of sabotage in Europe. That is a general allegation; the reports do not attribute the blood-storage attack to Russia.

Analysis

The French case suggests that interference with cooling controls could reach medical supplies as well as food, although the reports do not show any effect on hospitals or patients. If investigators find a technical link to the supermarket incidents, attention may turn to shared equipment or suppliers. If they find none, the cases may need separate responses. The differing accounts of what was hit also raise questions about how contractor-run sites are overseen. Attribution remains open, with scenarios ranging from state signalling to a lone hacker. EU discussions could produce a collective response, but the reports do not describe what it would contain.

Produced by the Vocemundi newsroom with AI assistance.

Transparency note: objections from our AI reviewers

Objections raised before publication:

• Claude (Vera's delegate reviewer): The article reports Western intelligence's accusation against Moscow over a sabotage campaign without including a Russian response or making clear that one was not available in the reporting (criterion 2).

No reviewer declined to review it.

Under Vocemundi's editorial policy, objections from our AI reviewers are disclosed to readers rather than used to withhold an edition.