Short answer
The Etablissement francais du sang (EFS) said on 3 November 2026 that a cyber incident at its refrigeration equipment provider disrupted the supervision of cold rooms at three sites, pushing temperature and defrost thresholds to very high levels. EFS says alarms caught it quickly, no health impact was identified and no blood products were lost.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Etablissement francais du sang (EFS) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | Healthcare (blood service) and refrigeration supply |
| Country | France |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-03 |
| People or records affected | Cold-storage rooms at three EFS sites; no loss of blood products reported |
What data was exposed
- No data theft or personal data exposure has been reported
What happened
The Etablissement francais du sang (EFS), which collects and distributes blood in France, said on 3 November 2026 that a cybersecurity incident at its refrigeration equipment provider disrupted the supervision and control systems of cold rooms at three of its sites. According to EFS, temperature and defrost thresholds were pushed to very high levels. The rooms held plasma bags for transfusion and plasma used to make medicines, as well as biological samples.
BleepingComputer, citing the EFS statement, put the date of the incident at 2 November. franceinfo reported the same on 4 November.
What EFS says about the impact
EFS said its alarm systems flagged the anomalies quickly. Staff then repaired or isolated the equipment and moved products to other storage as a precaution. In its words, quoted by franceinfo, no health impact has been identified and no loss of blood products is to be reported. Collection and distribution continued without interruption, according to BleepingComputer.
The office of Health Minister Stephanie Rist said technical investigations were continuing and promised an update. EFS says it is working with the national cybersecurity agency ANSSI and the Ministry of Health and has strengthened monitoring of equipment operation and temperatures.
The supplier
EFS did not name its provider. Franceinfo reports that Le Canard enchaine identified it as Coolworld. Coolworld said the weakness involved a component supplied by a third party that it does not directly control, and that only a limited number of units were affected. It did not comment on individual cases. Press reports of specific temperature targets differ and were not confirmed by EFS, so we do not repeat them.
Wider context
BleepingComputer links the incident to attacks on refrigeration controllers in October and November that hit supermarkets in France and other European countries, including the earlier French supermarkets refrigeration cyberattack. It reports that a Belgian refrigeration company said the November attackers used the same weakness as in October. It also notes that CISA disclosed two flaws in a controller line in 2025 but that exploitation of those flaws in these attacks has not been confirmed.
What this means for the public
No donor data theft has been reported. The scam risk is indirect: appeals and fake messages tend to follow stories about blood shortages and cyberattacks. Donate only through official EFS channels.
See our guide to phishing messages and the data breach checklist.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake blood-donation appeals or 'urgent shortage' messages that exploit news of the attack to collect personal or payment details.
- Phishing emails posing as EFS, a hospital or a government agency that ask donors to log in or confirm an appointment through a link.
- Scam calls offering 'security checks' or 'compensation' to people connected to the incident.
What to do if you are affected
- 01Book donations only through the official EFS site or app, never through a link in an unsolicited message.
- 02Ignore appeals that ask for payment, card details or a password. Donating blood does not require any of them.
- 03If you operate refrigeration or building controllers, apply supplier updates and remove internet exposure of control panels, as the FBI and CISA have urged in their warning on refrigeration systems.
- 04Report suspicious messages to the French platform Signal Spam or Cybermalveillance.gouv.fr.
Frequently asked questions
Was EFS the target of the attack?
EFS said it was not the direct target. Its refrigeration equipment supplier was. Le Canard enchaine identified the supplier as Coolworld, which says the weakness was in a third-party component outside its direct control.
Was any blood or plasma lost?
EFS says no health impact was identified and no loss of blood products has been reported. Its alarms flagged the anomalies quickly and products were moved to other storage as a precaution.
Was personal data stolen?
Neither BleepingComputer nor franceinfo reported any data theft. The impact described is on temperature control, not on donor records.
Is this linked to the supermarket refrigeration attacks?
BleepingComputer links it to a wave of attacks on refrigeration controllers in Europe. That is context from the outlet. Whether the same actors or flaws were involved in the EFS case has not been confirmed by the authorities we checked.
Sources
- Cyberattack disrupts blood storage refrigeration systems in France, BleepingComputer, 2026-11-04
- Une cyberattaque touche des installations frigorifiques utilisees par l'Etablissement francais du sang, sans impact sur les echantillons conserves, franceinfo, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.