While the focus last week was on supermarket refrigeration attacks, similar incidents have been seen impacting cold storage for blood and plasma products in hospitals. Between Sunday and Monday (1 – 2 November 2026), three blood banks in France were targeted.¹ Temperature and defrost thresholds were increased to extreme levels at three Établissement français du sang (“EFS”) (national blood service in France) plasma storage locations.² This time however, it was not about the value of the wasted items, but the mitigation put in place.

The EFS stated that there was no loss of any blood products, no adverse health effects, and no impact on blood collection and distribution.² Due to the alerts, employees were notified with enough time to move the blood to non-connected refrigerators.¹ This is a great example of a claim based on mitigation costs. When organisations face an attack like this, costs to move the products, put into temporary storage, inspect and monitor equipment will need to be considered. Evidence should be gathered to show what action was taken to mitigate the impact on refrigeration and what costs were incurred.

What Happened

Temperature and defrost thresholds were increased to unsafe levels at three cold storage locations.²  These units contained blood products ready for delivery to hospitals and biological samples (plasma used for transfusion and medicine production) held by the EFS.³

The EFS explained that it was not specifically targeted, but it have not named the refrigeration provider. Coolworld Rentals, a European refrigeration equipment provider, have confirmed that it was impacted by a cybersecurity incident via its remote monitoring software.  A vulnerability was exploited within a component provided by a third party.³

It is less clear exactly how high the temperature got as there are mentions of programming and actual temperatures.  The incident was first reported by the French weekly newspaper Le Canard enchaîné who stated that the cold stores were programmed to increase to 110°C instead of -30°C.⁴  The difference here was that the alerts allowed staff enough time to protect the inventory.  An EFS spokesperson explained that staff are present at the location 24/7 due to the blood potentially being needed at any time.

Near Miss ≠ Nothing to Claim

Many cyber and property policies will cover reasonable costs to mitigate or reduce any loss.  For the EFS this could include overtime to move products, using spare cold storage, emergency engineer visits, repairs to units, increased temperature checks, and any technical investigations.  The EFS have stated that it has increased monitoring of its refrigeration equipment and temperatures.³ Some of this could be seen as emergency costs but some of it may be a long-term improvement. Insurers will see this differently, so it is important to keep costs separated from the start.

The amount of loss that could have been avoided will also be a factor. Mitigation costs will often be compared to what was saved.  Claims will be stronger if they can show what could have been lost.

Valuation of the Product

Last week we looked at how products can be valued at retail prices within supermarkets and how double counting can be avoided.  However, blood plasma is not sold from shelves, so there won’t be an obvious retail price to start from. Some of the plasma was also for medicine production.²

If there had been a loss of product, costs to replace would be the most likely question.  This would include costs to collect, process, test, store, and costs to source products elsewhere in the event of a shortage.  Biological samples are harder to value as some cannot be replaced.  Policies will vary on how they will cover items like this.

Who’s Loss?

This incident adds another party to the claim. Coolworld stated it is a rental and monitoring provider who had units using a component provided by a third party.³ This means there are at least three businesses potentially interested in the loss: (1) Cold storage user, (2) Equipment and remote monitoring provider, (3) Vulnerable component provider.

As always, there will be questions about contractual liability, coverage, and potential recovery. However, this is in a less common area of remotely monitored refrigeration equipment. The rental agreement will usually state who is responsible for insuring the equipment and who will bear the risk of failure. Some cyber policies will only cover contingent business interruption for providers with a written contract in place or only IT providers.  A refrigeration rental provider with remote monitoring software may or may not fall into this category.  If the insurer is paying, it may look to recover from the supplier, so having clear records of the timeline and costs will be important

When Will the Equipment Be Back Online?

The French Health Ministry and national cybersecurity agency began an investigation into the attack.²  How soon the equipment can be brought back online can be a loss in itself.  If the equipment is offline while being repaired or replaced, costs may be incurred for temporary storage, manual monitoring, and extra handling.

For business interruption purposes, the period of restoration can run until the property could have been repaired or replaced with reasonable speed.  If the equipment is offline due to a security review, there may be a debate over whether that time is included in the period.  Keeping dated records of decisions and who made them will help.

Evidence that Helps

As noted in last week’s article, the key component to consider with these claims is the timing and temperatures. Often the main source of evidence will be from the device that was controlled by the attackers.  The EFS have shown the importance of having an alternative source of evidence.  The monitoring and alert systems quickly identified the change so staff could act and move the product to non-connected storage.¹  Since this incident, Health-ISAC (threat sharing group for the healthcare industry) have issued a warning to members that it has seen a wave of attacks on refrigeration controllers.  It has advised its members to isolate controllers, train staff on manual controls in case of emergency, and have offline backups.⁵

For any business using cold storage, the key points will be similar to last week’s discussion around supermarket impact:

• Keep independent temperature logging that does not depend on the controller.

• Before units are reset, preserve alarm histories and staff response times to same.

• Record which products were moved, where to, and when, along with their temperatures on arrival.

• Book emergency costs, upgrades, and routine operating costs separately.

• Review service agreements to see who is responsible for insuring the equipment.

Path Forward

This attack on the EFS shows that this campaign is not limited to supermarkets. Since the initial reports, the EFS have stated it is working with the national cybersecurity agency (ANSSI) and Health Ministry.³  However, at this time, there is no concrete information on who is responsible.⁴  It is also not confirmed if the two vulnerabilities previously disclosed in 2025 affecting certain Danfoss controllers have been exploited.³  Ahold Delhaize, who suffered a separate cyberattack on its IT systems in October,⁶ have since stated it expects the incident to have an impact of up to €250M on fourth quarter sales.⁶

On the 5th of November, the Cybersecurity and Infrastructure Security Agency, FBI, and US Departments of Health and Human Services, Agriculture, and Transportation issued a joint fact sheet.  On it, they have warned that attackers are targeting refrigeration and cold chain monitoring systems which are commonly used in healthcare, food and agriculture, chemicals, and transportation.⁷  In their post about the fact sheet, the FBI has mentioned it has seen an attack on "three foreign blood service facilities" which was unsuccessful "due to the proper alert mechanisms in place."⁸

From a claims point of view, the EFS outcome is the positive version of this story.   The loss was largely avoided, mainly due to the alerts and quick action. However, the costs of that response, the time equipment stays out of service, and the questions about who carries the risk all remain relevant.  These will be easiest to record during the initial few days following the incident.

Sources

1. Reuters, "French Blood Banks Hit Alongside Cyberattack on European Supermarkets," 4 November 2026.

2. Euronews, "Cyberattack hits French blood banks but no samples compromised, officials say," 4 November 2026.

3. BleepingComputer, "Cyberattack disrupts blood storage refrigeration systems in France," 4 November 2026.

4. France 24, "French blood banks foil new cyberattack targeting refrigerators," 4 November 2026.

5. NPR, "Health intel-sharing group warns industry in wake of cyberattack on French blood bank," 6 November 2026.

6. SecurityWeek, "Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack," 6 November 2026.

7. Cybersecurity and Infrastructure Security Agency, "CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity," 5 November 2026.

8. FBI Cyber Branch, LinkedIn post on threats to industrial refrigeration and cold-chain monitoring systems, 5 November 2026.