Cyberattacks are evolving, and their targets are no longer limited to companies, financial institutions, or databases containing confidential information. Over the past few years, digitalization has progressively connected industrial facilities, public services, and equipment that previously operated in isolation. This transformation has improved the efficiency of numerous processes, but it has also created new opportunities for those seeking to exploit technological vulnerabilities. A recent example has occurred in France, where refrigeration systems used to preserve blood plasma were targeted in a cyberattack.
The incident has raised concerns because the affected equipment belongs to infrastructure directly related to healthcare. According to a report published by Xataka on November 4, 2026, the attackers targeted Coolworld's freezers, a company that provides refrigeration equipment used by the French Blood Establishment (EFS). These devices make it possible to preserve plasma samples at temperatures close to -30 degrees Celsius. Although the authorities managed to bring the situation under control before any losses occurred, the event demonstrates that a cyberattack can affect even resources that are essential to medical care.
The situation is particularly noteworthy because incidents involving freezers and refrigerated storage rooms in European supermarkets had previously been reported. In those cases, refrigeration systems were also subjected to tampering that could cause changes in food preservation conditions. The shift from commercial facilities to equipment used by blood banks represents a significant change in the nature of the risks. It is no longer merely a matter of potential financial losses, but of threats that could compromise resources needed for certain medical treatments.
What Happened to the Freezers at French Blood Banks?
According to the published information, those responsible for the incident did not directly attack the EFS's central systems, but rather the refrigeration equipment provided by Coolworld. This circumstance highlights the importance of also protecting technology providers involved in essential activities. An institution may have advanced security measures in place and still be exposed through an external company that manages part of its facilities. Therefore, cybersecurity protection must extend throughout the entire service chain and not be limited exclusively to internal systems.
The procedure described involved attempting to modify the freezers' temperature settings. The equipment was configured to keep plasma samples at approximately -30 degrees Celsius, but the attackers attempted to raise the threshold to 110 degrees. This modification could have altered the preservation conditions if it had not been detected in time. However, it is important to clarify that changing a programmed parameter does not necessarily mean that the inside of the freezers actually reached that temperature.
The intervention prevented the incident from affecting blood supplies. According to statements reported by Xataka, the French authorities assured that no products had been lost and that collection and distribution activities continued normally. France's National Cybersecurity Agency and the Ministry of Health participated in the actions related to the investigation. Although further technical details are still needed, the response demonstrates the importance of having monitoring mechanisms and emergency protocols in place.
Why Does Blood Plasma Require Special Protection?
Plasma is one of the main components of blood and performs essential functions in the human body. It is composed primarily of water and contains proteins, mineral salts, nutrients, and other substances necessary for different physiological processes. Among its components are clotting factors, which participate in the mechanisms that help control bleeding. Because of its properties, plasma has important medical applications and also serves as a raw material for manufacturing medicines derived from blood proteins.
Some treatments made from plasma are used to care for patients with blood-clotting disorders, immunodeficiencies, and other diseases. Their availability depends on a chain of procedures that begins with donations and continues through collection, processing, storage, and distribution. Each of these stages must meet specific health requirements to ensure that the products can be used safely. Therefore, an interruption in preservation systems could have consequences extending beyond the equipment directly affected.
The cold chain is particularly important because it makes it possible to keep blood components within established temperature ranges. The World Health Organization provides recommendations for preserving blood products throughout the different stages of their storage and transportation. In the case of frozen plasma, the conditions depend on its classification, preparation, and applicable regulations. A temperature deviation may require the samples to be assessed to determine whether they remain suitable for use.
A cyberattack against these systems could cause the loss of products that require time and resources to obtain. Furthermore, plasma availability does not depend exclusively on the number of donations, but also on each center's processing and storage capacity. If several facilities experienced problems simultaneously, healthcare authorities would have to reorganize supplies and deliveries. This demonstrates that digital security is also part of protecting medical resources.
From Supermarkets to Critical Infrastructure
Incidents involving freezers in European supermarkets served as a warning about the risks associated with connected industrial devices. Although they may initially have appeared to be attacks intended to cause food losses, they also demonstrated that certain physical equipment can be manipulated through its computer systems. Commercial refrigeration increasingly depends on sensors, controllers, and platforms that make it possible to monitor facilities remotely. When these components have vulnerabilities, they can become targets for malicious activities.
The French case shows that the same type of risk can spread to much more sensitive sectors. A supermarket may suffer financial losses if its freezers stop working properly, but a blood bank manages products intended for patients who need medical care. The difference lies not only in the economic value of the affected goods, but also in the possible consequences for healthcare services. For this reason, any cyberattack against these facilities requires a response that takes both cybersecurity and continuity of care into account.
The situation also encourages a review of the security of other industrial systems. Electrical facilities, water networks, air conditioning systems, hospitals, and transportation infrastructure use connected technologies to monitor and control their operations. These devices facilitate maintenance and make it possible to respond to certain problems without the need for immediate on-site intervention. However, connectivity also increases the opportunities for third parties to attempt to access systems that can directly influence the operation of physical facilities.
Potential Consequences for Hospitals and Patients
Although the French cyberattack did not result in plasma losses, it is necessary to analyze what could happen if a similar incident were not detected in time. The preservation of blood components is part of a logistical chain that begins with donations and continues through testing, separation, storage, and distribution processes. Each stage requires specific controls to ensure that products meet the necessary conditions before reaching medical centers. A significant disruption at any of these stages can create operational difficulties that extend beyond the facility initially affected.
If a refrigerated storage room stopped maintaining the appropriate temperature for a significant period, those responsible would have to assess the stability of the stored products. Depending on the type of component, the time elapsed, and the recorded conditions, some units might no longer be suitable for use. Products that did not meet health requirements would have to be separated and discarded according to the relevant procedures. This situation could temporarily reduce available supplies and require distribution to be reorganized among different centers.
The consequences would also depend on the quantity of affected products and the healthcare system's response capacity. An institution with alternative supplies, backup facilities, and distribution agreements with other centers may have a greater ability to maintain its activities. By contrast, a region with limited resources could experience greater difficulties if several facilities encountered problems simultaneously. In any case, it would not be correct to assume that a cyberattack against a freezer automatically causes a national crisis, because the actual impact depends on numerous operational and healthcare-related factors.
There is also a human dimension that must not be overlooked. Blood products are not ordinary commodities, but resources obtained through voluntary donations and intended for people who need medical treatments. Behind every stored unit are selection, testing, and preparation processes that require time, financial resources, and specialized work. Compromising their availability means putting part of the healthcare system's capacity at risk and wasting resources that could have benefited other patients. For this reason, cybersecurity incidents affecting the healthcare cold chain must be treated as potential threats to the continuity of medical services.
The Internet of Things and New Vulnerabilities
The Internet of Things, known as IoT, makes it possible to connect physical devices to computer networks to collect information and exchange instructions. This technology is present in homes, companies, factories, and healthcare centers. Temperature sensors, monitoring systems, and industrial controllers are some examples of devices that can be used to automate tasks. Their integration facilitates facility management, although it also requires appropriate security measures.
One of the problems is that many industrial devices have a long service life. Replacing them can be expensive and may require operational interruptions, so some organizations continue using devices designed before connectivity became a common feature. These devices may continue to function properly from a mechanical perspective while having limitations in terms of cybersecurity. The lack of updates and the use of older technologies can increase their exposure to certain threats.
Another problem arises when different companies participate in managing the same infrastructure. The facility owner may be responsible for operations, while an external provider manages the equipment and another specialist maintains the computer systems. If responsibilities are not clearly defined, certain vulnerabilities may go unnoticed. For this reason, organizations need to know which devices they have connected, who can access them, and what measures each provider applies.
The United States National Institute of Standards and Technology (NIST) has developed recommendations to improve the security of IoT devices. Its documents highlight the importance of managing access, keeping equipment up to date, and assessing risks throughout its entire life cycle. These measures help reduce the exposure of devices involved in important processes. In healthcare facilities, their implementation becomes particularly relevant because a digital alteration can affect the physical preservation conditions of certain products.
Artificial Intelligence and Its Relationship with Cyberattacks
Artificial intelligence has introduced new possibilities in the field of cybersecurity, both for protecting systems and for facilitating malicious activities. Its tools make it possible to analyze large amounts of information, automate tasks, and recognize patterns in datasets. These capabilities can be used to detect suspicious behavior and improve defense systems. However, they can also help cybercriminals carry out certain activities more quickly.
One concern is that artificial intelligence may facilitate the analysis of software, technical documentation, and potential vulnerabilities. It can also be used to create more convincing fraudulent messages or automate certain investigative tasks. This could reduce the time required to prepare some attacks and expand the number of targets that can be examined. Nevertheless, having artificial intelligence tools does not mean that anyone can automatically compromise industrial infrastructure.
In France's case, it has not been confirmed that artificial intelligence played a role in the cyberattack against Coolworld's freezers. The information published by Xataka explicitly states that there are still insufficient details to establish such a connection. The possibility that these tools may have facilitated the incident must be treated as a hypothesis and not as a proven fact. To determine the procedure used, it will be necessary to have the results of the technical investigations.
The United Kingdom's National Cyber Security Centre has warned about the possible growth of attacks that take advantage of artificial intelligence capabilities over the coming years. Its assessments consider risks to critical infrastructure and systems that use older technologies. These warnings reinforce the need to improve organizational preparedness, although they do not make it possible to claim that all future attacks will use artificial intelligence. Prevention must take into account both emerging threats and traditional vulnerabilities.
External Providers as Part of Corporate Security
The French incident highlights a fundamental aspect of cybersecurity: the protection of technology providers. Many organizations depend on external companies to manage servers, maintain equipment, provide connectivity, or monitor facilities. This collaboration makes it possible to access specialized knowledge and optimize resources, but it can also introduce additional risks. If a provider suffers a cyberattack, the organizations that depend on its services could be affected.
The relationship between Coolworld and the French blood bank system helps illustrate this situation. Healthcare centers need refrigeration equipment to preserve their supplies, while the provider participates in the operation of that infrastructure. Therefore, the security of the freezers does not depend exclusively on the measures adopted by the healthcare organization. It is also necessary to assess the controls implemented by the companies that have access to the equipment.
To reduce these risks, companies must review their providers' security conditions before establishing business relationships. They also need to know what external access points exist and what permissions are granted to manage the systems. Technology contracts should include responsibilities related to information protection, incident reporting, and service continuity. These measures help prevent an external vulnerability from ultimately compromising an entire operation.
How Can a Cyberattack Against Industrial Systems Be Prevented?
Prevention begins with an up-to-date inventory of connected devices. Organizations must identify the equipment involved in their operations, understand its technical characteristics, and determine which connections it uses. This information makes it possible to identify the components that require greater protection and facilitates the planning of updates. It also helps detect older devices that may require additional monitoring measures.
Another important measure is controlling remote access. Administrative accounts must use strong authentication mechanisms and have only the permissions necessary to perform their functions. Likewise, it is advisable to periodically review providers' access privileges and remove those that are no longer used. In this way, the possibility that a compromised account could allow someone to interfere with important systems is reduced.
Network segmentation also helps limit the consequences of an incident. It consists of separating systems that perform different functions to prevent a problem from easily spreading throughout the entire infrastructure. Industrial equipment should not be unnecessarily exposed to general-purpose networks. Its connection must respond to specific operational needs and be accompanied by security controls.
Organizations also need independent mechanisms to monitor the physical operation of their facilities. In the case of freezers, this means checking that temperature records match the actual preservation conditions. Alerts must make it possible to identify abnormal changes and facilitate rapid intervention. If an incident occurs, those responsible need clear procedures to protect stored products and transfer them when necessary.
Finally, contingency plans must be tested periodically. An organization needs to know how to act if it loses control of a device, stops receiving information from its sensors, or a provider experiences a security incident. Drills make it possible to identify coordination failures and verify whether personnel understand their responsibilities. Preparedness is just as important as the technological tools used to prevent a cyberattack.
The cyberattack against the refrigeration equipment used by French blood banks demonstrates that digital threats can reach infrastructure that is essential to society. Although the incident was brought under control and did not result in plasma losses, it highlighted the importance of protecting connected industrial systems. The situation also showed that organizations can be exposed through external providers involved in the operation of their facilities. Therefore, cybersecurity must be understood as a shared responsibility.
The expansion of the Internet of Things and the development of artificial intelligence are changing the landscape of digital threats. However, not all incidents are related to these technologies, and there are still numerous vulnerabilities arising from older systems, inadequate access controls, and a lack of maintenance. Companies need to adopt preventive measures that take into account both their own networks and the physical devices they use. They must also assess their providers and have response plans in place that make it possible to maintain their operations during an emergency.
The French case offers an important lesson for organizations in all sectors: any connected system can become a target if it does not have appropriate protective measures in place. Preventing a cyberattack does not simply involve installing security tools, but also identifying risks, controlling access, monitoring devices, and preparing human teams. In sectors such as healthcare, these measures become even more important because technological continuity may be directly related to patient care.
At ITD Consulting, we help organizations strengthen their cybersecurity and protect their technological infrastructure against digital threats. If your company needs to improve its security systems, identify vulnerabilities, or strengthen its cybersecurity strategy, our team can guide you toward the most appropriate solutions. Contact ITD Consulting at [email protected] and discover how we can help you protect your business continuity and security.
EN 
ES