On November 2, hackers breached the cooling systems at three facilities operated by Établissement Français du Sang (EFS), France's national blood supply agency. The attackers targeted not EFS directly but the third-party vendor supplying its refrigeration equipment, attempting to raise the temperature of plasma storage units from −30°C to 110°C. The agency's alarm systems caught the spike before blood products were damaged, and staff relocated supplies to unaffected facilities as a precautionary measure. The blood attack is the most dangerous escalation in a wave of refrigeration cyberattacks sweeping Europe. On November 1-2, hackers hit supermarkets across Sweden, Belgium, and Estonia, remotely cranking freezer settings to 50°C. Some stores were forced to discard inventory. In October, a separate attack struck hundreds of French grocery stores; one Normandy shop owner told Business Insider he lost $112,000 (approximately ¥17.7 million) worth of food in a single incident. The attack vector is startlingly simple. Commercial cooling systems are internet-connected so technicians can monitor and maintain them remotely. A defrost function — designed to clear ice buildup — can be weaponized by setting target temperatures to dangerously high levels. Many of the compromised systems were running outdated software with known vulnerabilities. Who is behind the attacks remains unknown, and investigators have not publicly established whether the grocery and blood-supply incidents are linked. EFS said it is working with France's national cybersecurity agency (ANSSI) and the health ministry. The agency confirmed that blood collection and supply remain "fully secured" and that temperature monitoring has been "reinforced" across all facilities. The pattern reveals a structural problem: critical physical infrastructure — blood banks, food cold chains — now depends on networked IoT devices managed by third-party vendors with inconsistent patching discipline. The EFS attack succeeded not because the blood agency's own defenses failed, but because its supplier's equipment was the entry point. This is supply-chain risk in its most literal form. The timing compounds broader anxiety. A $6.3 billion cryptocurrency theft from Binance and newly discovered vulnerabilities in PHP — the programming language underpinning up to 70% of websites — have put cybersecurity in sharp focus. Refrigeration attacks add a visceral, physical dimension: this isn't stolen data or money, it's spoiled food and potentially compromised blood products. The lesson is blunt. Every internet-connected device in a critical supply chain is an attack surface. The defenses that saved the blood supply were legacy analog safeguards — temperature alarms and human responders — not the digital infrastructure itself. When the IoT layer failed, it was the pre-digital layer that caught it.
