France's national blood service, the Établissement Français du Sang (EFS), confirmed that hackers accessed control systems at three cold storage facilities overnight on Monday, boosting temperature and defrosting thresholds to "very high levels." The targets held plasma bags, platelets, and blood products destined for more than 1,900 hospitals serving over a million patients annually. Alarm systems triggered before products were compromised, and stocks were relocated to unaffected sites. The blood bank attack did not hit EFS directly — it exploited systems run by third-party refrigeration contractors, a detail that exposes the layered, outsourced architecture underpinning even the most critical health infrastructure. ANSSI, France's national cybersecurity agency, and the health ministry have been notified. EFS says monitoring across all its equipment has been reinforced. This incident sits inside a rapidly widening campaign. Earlier the same week, supermarket refrigeration systems across at least eleven European countries — Italy, Germany, Romania, the UK, Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands, and Sweden — saw temperatures spike as high as 50°C, destroying millions of euros of food. In France alone, hackers seized control of cooling units in as many as 700 supermarkets last month. A regional Crédit Mutuel branch also reported a cyber-attack on Wednesday. The pattern may extend across the Atlantic. In early August, mysterious fridge malfunctions hit commissaries on at least six US military bases. The Pentagon is investigating a suspected hack. The geographic breadth and target diversity — retail food, military commissaries, financial institutions, medical blood supply — suggest either coordinated state-level capability demonstration or an unusually prolific lone actor. Italy's government held emergency talks with intelligence officials. EU spokesperson Thomas Regnier confirmed urgent cross-national discussions, calling for collective resilience while declining to name suspects. No group has claimed responsibility. Rafe Pilling of Sophos assessed the most plausible scenarios as state-based signaling or a lone-wolf hacker. Western intelligence officials continue to point to Moscow's hybrid warfare campaign following the 2022 invasion of Ukraine. The technical vector is grimly straightforward: commercial refrigeration systems increasingly run on internet-connected software that can be monitored and controlled remotely. Without consistent patching, these systems present open code to anyone looking. The EFS attack demonstrates that the contractor supply chain — not just the primary operator — is a live attack surface, and the consequences of exploitation scale from spoiled food to endangered patients. What makes this escalation structurally dangerous is the target selection. Supermarket fridges impose economic costs. Blood bank cold stores impose mortal ones. The leap from retail disruption to healthcare infrastructure — even if the same technical exploit is used — crosses a threshold that demands a different category of response. The alarm systems worked this time. The question is what happens when they don't.
