Cyberattack hits refrigeration systems for donated blood in France
The attack came as hackers raised freezer temperatures in several European countries, causing extensive food spoilage and prompting investigations.
- A cyberattack targeted the French Blood Establishment (EFS), remotely reprogramming refrigeration systems for donated blood to a temperature of 110°C from their normal -30°C.
- An on-duty technician spotted the unusual temperature rise, allowing staff to stop the attack in time and prevent any damage to the blood supply or impact on patients' health.
- The incident is part of a wider, coordinated campaign targeting freezer systems in several European countries, with authorities investigating potential state-backed hackers from Russia or Iran.
- While two Russian hacking groups claimed responsibility, experts are skeptical and note the methods are also consistent with previous attacks linked to Iran.
A cyberattack raised temperatures in freezers used to store donated blood for medical use, the French Blood Establishment (EFS) disclosed, according to international media reports on Wednesday (November 4, 2026).
The EFS reported no damage to donated blood and no impact on patients’ health.
The incident came as hackers tampered with freezer systems in several European countries, raising temperatures and causing substantial losses as goods spoiled.
Cybersecurity experts said the attacks took place simultaneously in several locations.
They noted that hackers often changed temperature settings at night to maximise damage, a pattern that pointed to careful planning, including identifying internet protocol (IP) addresses and coordinating the attacks.
Findings from ‘honeypots’, decoy systems used by cybersecurity firms to attract hackers, indicated that the attackers had targeted only freezers in Europe.
Even the decoy systems in Ukraine went untouched.
The hacking groups NoName057(16) and Z-Pentest Alliance, described in the report as Russian, claimed to have breached Danfoss control systems.
Experts questioned whether the groups had falsely claimed responsibility, saying the attacks did not match the methods either group had used before.
Danfoss is a Danish refrigeration company.
French cybersecurity company Sekoia said the methods were consistent with those of Russian hackers or the Russian government, which has faced accusations of waging ‘hybrid warfare’ in Europe.
The company also pointed to clues suggesting possible involvement by hackers linked to the Iranian government.
To explain the possible link to Iran, the report cited similar attacks by Iran on industrial control systems at supermarkets in Israel in 2022 and on freezers at a minimum of six US military bases in August.
Authorities in several countries are stepping up investigations and issuing alerts to supermarkets and other organisations.
Officials have yet to confirm the perpetrators’ identities and are considering several possibilities, including state-backed hackers, copycats and teenagers causing disruption online.
The report said the attack took place overnight from Sunday into Monday and targeted Coolworld, which maintains refrigerated containers for the EFS, including at the blood service’s Bourgogne-Franche-Comté branch.
The freezers are normally kept at −30°C to preserve donor blood samples.
The report said hackers reprogrammed them with a temperature setting of 110°C.
The EFS said a technician on duty spotted an unusual rise in temperature during the night, allowing staff to identify and stop the attack in time.
France’s health ministry attributed the lack of disruption to operations to the early detection.
The report described the breach as the second such incident in France, following an attack in October that it said compromised refrigeration systems at more than 700 shops and forced them to discard food worth millions of euros.
