EFS Plasma Sites Escape Cold Storage Hack After Temperatures Spiked to 230 Degrees

French blood bank operators contained a cyberattack on Monday after intruders pushed cold storage temperatures to 230 Fahrenheit, or 110 Celsius, at three plasma sites. The French Blood Establishment, known as EFS, confirmed that the intrusion was stopped before any medical supplies were damaged. The standard operating temperature for these facilities is minus 22 Fahrenheit, or minus 30 Celsius.

EFS released a statement late Tuesday explaining that temperature and defrosting thresholds were raised to extreme levels at three of its plasma storage locations. Monitoring systems detected the irregularity quickly, allowing staff to intervene and secure the products. The organization stated that no health consequences were identified and no blood products were lost during the incident.

Le Canard Enchaîné first reported the details of the breach. The hackers targeted a refrigeration equipment supplier rather than the blood bank directly. The supplier, Coolworld, acknowledged the incident in a public statement. The company stated that the vulnerability involved a component from a third-party supplier that was outside of its direct control. Coolworld noted that only a limited number of units were affected.

The affected facilities stored bags of plasma intended for patient transfusions as well as plasma used in medicine manufacturing. EFS confirmed that all affected products were either secured or transferred to safe storage. Blood collection and distribution operations remained uninterrupted, ensuring hospitals and healthcare providers continued to receive necessary services.

France’s national cybersecurity agency and the Health Ministry are currently investigating the breach. The Health Ministry has not yet indicated who might be behind the attack. This incident follows a wave of similar cyberattacks in mid-October that targeted freezers and refrigerators at hundreds of supermarkets in France, Belgium, and the Netherlands. Those earlier attacks resulted in the spoiling of tons of food and caused millions of dollars in losses.

Ahold Delhaize, a Dutch supermarket chain hit in October, provided updated financial expectations on Wednesday. The company anticipates that the cyberattack will reduce its fourth-quarter sales by as much as 281 million dollars, or 250 million euros. It also expects operating income for the period to drop by over 112 million dollars, or roughly 100 million euros.

Franz Muller, the CEO of Ahold Delhaize, stated in a release accompanying the company's quarterly earnings that most disruptions were contained within two weeks. He noted that work continues to fully restore normal operations and that cyber threats are an increasingly harsh reality in modern business. The company previously attributed the October incident to malicious actions by external parties and proactively took several systems offline to mitigate further risks.