The EFS said its own systems had not been directly targeted, and that safeguards prevented any loss of blood products. The affected equipment stored blood samples and frozen plasma, including plasma intended for transfusion. The organisation said it had notified France's cybersecurity agency, ANSSI, and the Ministry of Health, but did not publicly name the supplier. According to reports, attackers changed cold-room temperature settings from -30°C to 110°C, though the equipment and its contents did not necessarily reach the higher temperature.
"The EFS' monitoring and alarm systems enabled the rapid identification of these anomalies and the implementation of necessary measures to ensure that no blood samples or products were compromised," the organisation said. "Thus, depending on the circumstances, as soon as the incident occurred, the affected equipment was either brought under control without impacting the products and samples, or neutralized; the products stored in these cold rooms were preventively transferred to other facilities."
News of cyberattacks targeting refrigeration equipment across Europe emerged on Monday morning, when retailers arrived at work to find puddles on the floor after cyber criminals activated defrost modes. Those attacks involved remotely activated defrost cycles and temperatures as high as 50°C, forcing retailers to discard spoiled food. Stores in Belgium, Ireland, Luxembourg and Sweden reported first, with cases since confirmed in Estonia, Finland, Germany, Portugal, Romania and the Netherlands. The attackers have not been identified.
In the UK, Richard Horne, chief executive of the National Cyber Security Centre, told BBC Radio 4's Today programme that he was aware of "a couple of impacts" in the UK's food supply chain. No affected UK businesses have publicly identified themselves, although the British Association of Independent Meat Suppliers told the BBC that some of its more than 300 members had become "collateral" in the attacks, with two reporting that their fridges had begun defrosting.
The current wave follows a similar attack a month earlier on French supermarket chains including Carrefour, Coopérative U, Intermarché and Monoprix. CERT-FR then published an advisory urging organisations to remediate vulnerabilities in Danfoss AK-SM and AK-SC controllers; some affected chains identified Danfoss controllers in their systems, while others said they did not use the company's equipment. Whether the attack on the EFS used the same access route remains unclear. Reported compromises at US military commissaries in August also led to food wastage.