H-ISAC TLP White Threat Bulletin: Alleged Attack on French Blood Establishment (EFS)

On November 4, 2026, reports on the alleged attack on the French Blood Establishment (EFS) started circulating in French news outlets. 

While the alleged attack has been reported in the news outlets, at this time no relevant government websites have published an official press release to substantiate it.

This alert is issued for situational awareness, highlighting how recent operational technology (OT) attacks against specific refrigeration brands directly intersect with emerging threats to the health sector.

Additional Info

These reports claim that unknown threat actor targeted Coolworld, a maintenance contractor for France's national blood agency (EFS), during the night of November 1st to 2nd, attempting to heat deep-freeze units storing donor blood samples.

However, allegedly, the overnight temperature spike was spotted in time, allowing staff to intervene before the products were compromised. The reports also claim the France's Health Ministry confirmed that because the attack was promptly caught, it caused no operational impact on blood supplies or transfusion services; however, no official report on the Ministry’s website has been released at this time.

Although official sources have not yet validated these reports with official press releases, the threat remains highly relevant to the health sector.

To counter the ongoing wave of refrigeration attacks and related cyber campaigns targeting operational technology (OT), Health-ISAC urges members to implement the following safeguards:

• Scan and shut down all public-facing IP ports for refrigeration controllers, BMS supervisors, and serial-to-Ethernet gateways (e.g., Dixell, Carel, Emerson).
• Isolate all refrigeration, medical gas, and telemetry devices on dedicated VLANs completely segregated from general hospital IT and guest Wi-Fi, blocking cross-traffic by default.
• Identify and isolate third-party 4G/5G gateways or vendor modems attached to chillers, forcing their traffic through managed enterprise firewalls or private APNs.
• Replace persistent vendor VPNs with Just-In-Time (JIT) privileged access requiring multi-factor authentication (MFA) that automatically expires after maintenance windows.
• Funnel all external technician sessions through an intermediary jump server that logs commands and records sessions, banning unmonitored tools like TeamViewer or AnyDesk.
• Place independent, hard-wired mechanical thermostats or thermal relays in series with heating and compressor circuits to physically cut power if limits are exceeded, regardless of software overrides.
• Replace generic manufacturer credentials (admin/admin, 1234) across all local controller displays, supervisory web servers, and Modbus/BACnet bridges with unique, complex passwords.
• Never rely solely on the vendor’s own software for alarms. Use secondary, isolated IoT sensors (e.g., LoRaWAN) that report directly to internal security and clinical teams.
• Configure alarms to trigger immediately whenever operating parameters, defrost cycles, or target temperatures are modified, especially outside standard change-control hours.
• Train on-site biomedical and facility staff to engage physical mechanical bypasses to keep units running offline, and maintain offline backups of all controller configurations.

View the detailed report below.