The investigation is ongoing. ANSSI, France's cybersecurity agency, and the Health Ministry are investigating how the intrusion occurred, and the EFS says its teams are working with them. No group has been publicly blamed. The EFS is the only civilian blood collection and transfusion body in France, serving about 1,900 healthcare facilities. The cold-storage samples at the affected sites were reportedly used for transfusion monitoring and frozen plasma, which is why the case has drawn public attention.
The incident belongs to a wider wave of attacks on connected refrigeration. Hackers remotely tampered with supermarket cooling systems in Belgium, Sweden, Finland and other countries, causing spoiled food and losses in the millions of euros. Hundreds of French stores were hit by the same kind of attack weeks earlier. For attorneys, the case shows that an attack on industrial equipment can reach medical supply chains through a third-party vendor. The European Commission announced new emergency-preparedness guidance the day before the EFS disclosure, and the UK's cybersecurity agency has warned of rising incidents. Clients in healthcare, food distribution and cold-chain logistics should review vendor access to operational technology and their incident-response obligations.