Cybersecurity in healthcare is often associated with ransomware, stolen patient records, and disrupted hospital information systems. However, an attack this week highlighted another critical concern: cyberattacks affecting operational technology (OT) and supporting infrastructure that the health world depends on to maintain safe, reliable operations.
This week’s cyberattack targets blood-storage refrigeration
This week, France’s national blood service, Établissement français du sang (EFS), experienced a cyberattack affecting refrigeration systems at three facilities.
This follows recent food industry attacks in a number of European countries where fridges and freezers warmed up after they were remotely taken over. The EFS attackers followed the same course in manipulating temperature and defrost controls associated with the refrigeration equipment managed by a third-party service provider of blood plasma and other biological products. Some refrigeration settings were reportedly changed from approximately −30°C to as high as 110°C.
Blood plasma and other biological products require carefully controlled storage conditions to maintain their integrity and availability for patient treatment. Due to the type of products stored, the facility maintained 24-hour staffing. When the monitoring systems identified abnormal conditions, personnel were able to intervene before the blood products were compromised. EFS reported no product losses or interruption to blood distribution.
The incident demonstrates that healthcare OT cybersecurity extends beyond medical devices to include infrastructure essential to maintaining safe clinical environments.
Why ISA/IEC 62443 matters for healthcare
Internationally recognized ISA/IEC 62443 provides cybersecurity requirements and guidance for industrial automation and control systems. Its risk-based principles can also help healthcare organizations evaluate and protect applicable OT environments, including connected refrigeration equipment, building automation systems, and third-party services.
Several areas are particularly relevant:
- Identifying and assessing risk (ISA/IEC 62443-3-2): What are the potential consequences, and how should the environment be arranged to manage the risk?
- Third-party access and supplier accountability (ISA/IEC 62443-2-1, 2-4, and 3-3): Establishing cybersecurity requirements for vendors maintaining connected equipment.
- Network segmentation (ISA/IEC 62443-3-2 and 3-3): Separating critical operational systems from less-trusted networks and restricting unnecessary remote connectivity.
- Monitoring and incident response (ISA/IEC 62443-2-1 and 3-3): Detecting unauthorized changes and maintaining procedures for timely intervention.
- Operational resilience (ISA/IEC 62443-2-1 and 3-3): Ensuring essential equipment and services can continue operating when supporting digital systems become unavailable.
An essential first step in protecting healthcare operational technology is to conduct a high-level cybersecurity risk assessment, following the principles of ISA/IEC 62443-3-2. Rather than starting with a checklist of cybersecurity controls, organizations should first identify their critical operational systems and ask a fundamental question: What could happen if this system were compromised, manipulated, or made unavailable? For refrigeration systems storing blood products, the consequences could include loss of valuable medical supplies, interruption of essential healthcare services, financial losses, and, ultimately, risks to patient safety.
The assessment should consider credible threat scenarios, existing vulnerabilities, the likelihood of successful exploitation, and the severity of potential operational consequences. Once these risks are understood, appropriate and proportionate controls can be identified to reduce them to acceptable levels. These might include restricting remote access, network segmentation, independent temperature monitoring, alarms, mechanical safeguards, and documented incident response procedures.
Organizations should also consider how they would detect and respond to an attack, whether they could maintain safe operations without the compromised systems, and how often they test these capabilities. The objective is not simply to prevent cyberattacks, but to ensure that essential healthcare services remain safe and resilient when attacks occur.
Protecting more than patient data
This recent healthcare incident demonstrates that cybersecurity must expand beyond protecting patients’ confidential information to include maintaining the integrity and safety of systems that support essential medical services.
Sources
- Sylvie Corbet, “French Blood-Storage Refrigeration Cyberattack,” Associated Press, Nov. 4, 2026. Accessed Nov. 6, 2026. [Online]. Available: https://apnews.com/article/france-plasma-blood-bank-cyberattack-temperature-fridge-12b80bcf93b8404264209e519c204919
- France 24. Cyberattacks Hit French Blood Bank Site, No Blood Products Compromised. (Nov. 5, 2026). Accessed: Nov. 6, 2026. [Online video]. Available: https://www.youtube.com/watch?v=32rxM8F59ms
- Health-ISAC/American Hospital Association, “Threat Bulletin on French Blood Establishment,” Nov. 4, 2026. Accessed: Nov. 6, 2026.[Online]. Available: https://www.aha.org/h-isac-green-reports/2026-11-04-h-isac-tlp-white-threat-bulletin-alleged-attack-french-blood-establishment-efs
