Hackers remotely raised temperatures in blood storage refrigerators at three French Blood Establishment sites on Monday, but alarms prevented any loss of blood products.

The attack occurred on November 2 at facilities run by the Établissement français du sang (EFS), which manages blood collection and distribution across France. Temperature and defrost settings in cold-storage chambers were pushed to extremely high levels. French media reported the settings were raised to 110°C from a normal minus 30°C, though the EFS did not confirm that figure. The units held plasma for transfusions, plasma for manufacturing medicines, and biological samples.

The EFS was not directly targeted. Instead, attackers breached Coolworld Rentals, a European refrigeration equipment provider that supplied the monitoring systems. Coolworld confirmed a cybersecurity incident involving remote monitoring software and said the vulnerability related to a third-party component outside its direct control. The company said only a limited number of its units were affected.

EFS monitoring and alarm systems detected the temperature change quickly, allowing staff to fix the equipment or transfer products to other facilities. The EFS said no health impact was identified and no blood products were lost, and blood collection continued without interruption. Technical teams are working with France's national cybersecurity agency, ANSSI, and the Ministry of Health.

The incident is part of a wider cyber campaign against refrigeration systems across Europe. In October, attacks disrupted systems at an estimated 250 to 350 French supermarkets. A second wave this month affected more than 115 stores in Belgium, the Netherlands, and Sweden, among others. Belgian refrigeration company Sabcobel said attackers exploited the same vulnerability used in October.

Two pro-Russian hacker groups, Noname057(16) and Z-Pentest, claimed responsibility for the supermarket attacks in a video, threatening further strikes on critical infrastructure. No group has claimed the blood bank attack, and the identity of the hackers remains undisclosed. Polish cybersecurity team CSIRT CeZ warned that attacks on blood storage systems require special attention and recommended disconnecting unsupported devices from the internet.

Experts say the attacks exploit vulnerabilities in operational technology systems connected to the internet for remote management. Robert Lee, CEO of cybersecurity firm Dragos, said large language models have made technical knowledge for attacking industrial equipment more accessible. He added that increased connectivity has expanded the attack surface. Other experts warn similar methods could target fuel stations, building automation, and medical facilities.