When Blood Plasma Is the Target of a Cyberattack: Healthcare Can Be Put at Risk This Way, Too

A cyberattack on technology that safeguards biological materials

During the night of 1–2 November 2026, refrigeration units at three sites of France’s national blood service, Établissement français du sang (EFS), were targeted in a cyberattack. According to information made public, the attack affected a third-party technology solution used to monitor and control refrigerated storage areas. This was not a conventional attack targeting a hospital information system or patient databases, but a compromise of technology with a direct impact on the physical operating conditions.

The attackers were able to remotely change temperature and defrost settings to extremely high levels. The affected areas contained blood plasma intended for transfusion, as well as plasma used in the manufacture of medicines. Disruption of the prescribed temperature conditions could have led to the loss of biological material and, consequently, reduced availability.

From a risk-management perspective, it is important that the incident affected more than the system’s information layer. The access obtained allowed the attackers to influence equipment settings on which the quality and usability of stored products depend.

Monitoring and alarm mechanisms played a decisive role by detecting the abnormal changes. Staff were able to respond in time, secure the affected equipment and move the products to other storage areas. The French blood service subsequently confirmed that no blood products were lost and their distribution was not interrupted. The incident was investigated by the relevant French authorities.

The case is also significant because of the source of the attack. The vulnerability was in a third-party technology solution - not necessarily in systems directly managed by the operator.

The IT–OT interface as a security risk

The incident in France highlights one of the key challenges to critical-infrastructure resilience: securing operational technology (OT) and its connections with information technology (IT). IT systems process, store and transmit data, while OT systems monitor and control physical processes. In healthcare, these may include regulating temperature and humidity, controlling refrigeration and freezer equipment, monitoring power supplies, or automating building systems.

A compromise of this technology can have direct operational consequences. An attacker does not need access to medical records or patient data. If they can change a device’s control parameters, they may disrupt conditions essential to the safe storage of biological materials, medicines or other sensitive products.

Remote service access and reliance on external technology providers pose particular risks. An operator may have its own network and information systems secured to a high standard, yet its security is also influenced, to some extent, by how suppliers access equipment, perform maintenance and manage the software solutions in use.

It is therefore not enough to assess only the organisation’s own cybersecurity. Risk analysis must also identify external dependencies, the scope of supplier permissions, authentication methods, records of remote access and controls over changes to technology-system settings.

For critical processes, a layered defence is important: separating IT and OT environments, limiting network communication to what is necessary, requiring multi-factor authentication for remote access, keeping thorough records of service activities and independently verifying critical operating parameters. Security measures must also take into account the need to keep the technology operating continuously and safely.

Interconnected processes in healthcare infrastructure

The French case broadens the view of what must be included in the protection of critical healthcare infrastructure. Healthcare security cannot be reduced to protecting hospital premises, information systems and medical devices.

Healthcare delivery depends on a broad system of connected activities. These include blood collection and processing, the preparation and storage of blood components, laboratory diagnostics, medicine storage, logistics, the distribution of medical supplies and the technical operation of healthcare facilities.

Blood plasma has a particular role. It is used in transfusion medicine and in the manufacture of plasma-derived medicines, with different requirements for processing, storage and quality control for each use. Maintaining the specified conditions throughout the process is therefore essential to the safety and usability of the final product.

From a critical-infrastructure perspective, the integrity of the entire process is crucial - from collection and processing through to storage and distribution. A failure in one technological or logistical component may limit the availability of products needed to deliver essential healthcare services.

This risk also has a systemic dimension. If an activity is concentrated at a limited number of sites or depends on specialised technology, an outage may affect services beyond the location where the incident occurred. When assessing criticality, it is therefore necessary to consider not only the importance of a particular piece of equipment, but also whether it can be replaced, whether alternative capacity is available, how long recovery may take and how a service interruption could affect other organisations.

What should the incident prompt Slovak critical entities to review?

The case in France is also relevant to Slovak critical-infrastructure operators. In the healthcare sector, risk assessments should cover not only information systems but also the technologies that maintain the physical conditions necessary for healthcare services.

In practice, organisations should review in particular:

• OT asset inventory: Are refrigeration and freezer units, monitoring systems, control units and other technologies included in the inventory of critical assets and in risk assessments?
• Supplier access management: Are remote service connections limited by time and purpose, protected by multi-factor authentication and monitored?
• Separation of technology environments: Is communication between IT and OT networks controlled so that a compromise of one environment cannot enable uncontrolled interference with the other?
• Independent monitoring: Can the operator verify actual temperature conditions if the control or monitoring system is compromised?
• Incident detection and response: Are there procedures for identifying abnormal setting changes, escalating alarms and making rapid decisions about the safe relocation of stored products?
• Operational alternatives: Does the organisation have access to alternative storage capacity, backup technology and procedures for restoring critical processes?
• Contractual and security requirements: Are suppliers’ responsibilities for cybersecurity, incident reporting, access management and service recovery clearly defined?

These questions are not limited to healthcare. Similar risks exist wherever the delivery of an essential service depends on automated control systems, sensors, remote management or third-party technologies. Examples include energy, water, food production and transport infrastructure.

Tibor Straka: Critical-infrastructure security must be assessed through dependencies

Tibor Straka, President of the Critical Infrastructure Association of the Slovak Republic, points out that protecting critical entities requires an understanding of how the service actually operates and of all the technological and supplier dependencies on which it relies.

“When assessing the security of critical infrastructure, we cannot focus only on protecting information systems or physical facilities. We need to understand the entire technology and supply chain on which the delivery of an essential service depends. Operational technologies and remote access by external suppliers deserve particular attention. If they are compromised, the physical operation of systems - and, in turn, the availability of a service - may be directly affected. The case in France shows that security measures must reflect real operational risks, not merely the formal scope of protection,” says Tibor Straka.

The Critical Infrastructure Association of the Slovak Republic considers the protection of technological and supplier dependencies an important topic for professional discussion about the security of critical entities. Sharing experience among operators, government institutions and technology companies can help identify risks that may manifest differently across sectors but have common underlying causes.



The incident in France is an important warning: cybersecurity for critical infrastructure does not end at the boundary of an organisation’s own information network. It also includes control systems, technological equipment, external suppliers and the processes that make essential services possible. The true level of protection is demonstrated not only by the existence of security policies and technical measures, but by an organisation’s ability to maintain or restore a critical service when one of its technological dependencies is compromised. In healthcare, this requirement carries particular weight, because a system failure may result not only in operational or financial losses, but also in a threat to the availability of healthcare.