Plasma at 110 °C: the hack on France's blood service

During the night of Sunday 1 to Monday 2 November 2026, an on-duty technician noticed that temperatures were rising in some cold rooms of the Établissement français du sang (EFS), France's public blood transfusion service. The rooms, which normally run at around −30 °C, had been remotely reprogrammed to reach 110 °C. Inside were donor samples and, as the EFS later told the Canard enchaîné, frozen plasma intended for transfusions.

The attack did not hit the EFS directly, but Coolworld, the supplier that operates and maintains part of its refrigeration equipment, particularly in Bourgogne-Franche-Comté. The French Ministry of Health, quoted by 20 Minutes, speaks of "zéro conséquence opératoire": the anomaly was spotted in time, and neither the transfusion chain nor patients were affected.

The situation is current as of 4 November 2026. The story was broken by the Canard enchaîné on 3 November. Coolworld has made no public statement, and it is not yet known how the attackers got in.

The blood was not about to boil

On social media the story spread with a movie-plot tone: the attacks on refrigeration in Europe had supposedly "reached medical infrastructure", and the attack had been stopped "before the blood boiled". Both claims go beyond the facts.

The 110 °C figure is a setpoint, meaning the temperature requested from the control system, not the temperature measured in the rooms. The Ministry itself made this clear, as reported by blue News. How high the temperature actually rose, and for how long, has not been made public. A refrigeration system is not an oven, after all: it can stop cooling and switch on the defrost heaters, but it will not take a cold room to 110 °C.

That does not make the incident any less serious, because for plasma the trouble starts much earlier. Fresh frozen plasma must be stored at −25 °C or below, as cyberattaque.org points out. If a batch stays above that threshold for long enough, it gets thrown away, no boiling required. The real risk was losing a stock that is hard to rebuild and depends on donors.

The "escalation" also needs to be cut down to size. The EFS incident happened the same night as the problems reported in supermarkets in Belgium, Luxembourg and Sweden, not afterwards. And according to 20 Minutes, investigators have not established any formal link with the campaign against supermarket refrigeration, which we covered in our article on hacked refrigeration in Europe. The parallel is an obvious one to draw, but it remains a hypothesis.

The weak point was the supplier

The most instructive detail in the whole affair is that it was not the transfusion service that was breached, but the company that handles the refrigeration. This is a supplier that, as part of its job, needs to see and change the settings of the equipment, often remotely, perhaps at night, perhaps for dozens of customers. Whoever gets into its systems ends up with the same power.

The October CERT-FR alert on the supermarket attacks was precisely about remote refrigeration controllers from Danfoss, Copeland and Dixell. There is, however, no public evidence that Coolworld uses these products, nor that the EFS attack went through them. Linking the incident to a specific CVE today would be making things up.

For anyone running a healthcare facility, the useful question is a different one: who can change the temperature of my fridges, and from where? Often the answer is not written down anywhere. The maintenance contract says what the refrigeration contractor has to do; it rarely says which network they connect from, with which accounts, whether those accounts are shared with other customers, and who notices if someone uses them at three in the morning.

What worked was a person, not software

In the French account, the control that stopped the damage was an on-duty technician who looked at the temperatures. We don't know whether that started from an automatic alarm or a routine check, but the point stands: someone saw a curve that didn't look right and acted.

There is one detail worth keeping in mind. Epoch Times reports that it remains to be seen whether the temperature rise was real or whether the display was manipulated too: "l'enquête le déterminera". If whoever controls the system can change both the setpoint and the value shown, monitoring that goes through the same system risks seeing only what the attacker wants it to see. For goods that cannot be replaced, like plasma, an independent measurement makes sense: a separate temperature logger, with its own probe and its own alarms, that depends neither on the controller nor on the supplier that manages it.

Then there is an almost trivial question to put to the manufacturer: why would a plasma freezer accept 110 °C as a setpoint? Sensible limits on parameters and an alarm on every setpoint change won't stop a determined attacker, but they turn a silent change into an event someone sees right away.

What this means for healthcare in Ticino

There are no known similar cases in Swiss healthcare. According to blue News, Coop reported attempted attacks on its refrigeration systems, without success, and Migros has seen no sign of attacks. But hospitals, clinics, laboratories, pharmacies, medical practices and vets all keep something cold: vaccines, medicines, reagents, samples. And very often the monitoring of those fridges is entrusted to an outside supplier, with remote access set up years ago.

Healthcare is also one of the critical infrastructure sectors for which, since 1 April 2025, there has been an obligation to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours, with exemptions for smaller organisations. If the attack comes through a supplier's system, knowing in advance who should notice it and who should report it saves you from finding out in the middle of the emergency.

Before updating anything, it pays to work out four pieces of information with your refrigeration supplier and whoever manages the network: which devices can be managed remotely, over which connection, with which accounts, and which independent check alerts a reachable person to an abnormal temperature. These are simple questions. The fact that often nobody can answer all four is the problem.

A check before the next night

At Webcracy we can help you map the remote access of your suppliers and maintenance contractors and check what is actually reachable from outside, as part of an authorised security assessment, working with your IT provider and whoever manages the equipment. The EFS got lucky because someone was watching. Better not to count on the same luck.

Let's check your suppliers' access↗

Original illustrative diagram by Webcracy.