Blood Bank Cyber Attack: Malaysia Lessons

A blood bank cyber attack in France this week went after something simple: the fridges. Attackers tried to push plasma storage to extreme temperatures, according to the French Blood Establishment (EFS). Alarms caught it, and no blood products were lost. For Malaysian hospitals, labs and suppliers, the lesson is clear: protect the equipment, not only the data.

What happened in the blood bank cyber attack

The EFS said temperature and defrosting thresholds were raised to extremely high levels on Monday 2 November. This happened at three cold-storage sites that hold plasma. The Associated Press reports that the attack hit a supplier of refrigeration equipment serving those sites.

Monitoring and alarm systems detected the changes, and staff acted. The plasma was either moved or secured. The EFS says no blood products were lost and no health effects have been found. Blood collection and distribution carried on.

France's national cybersecurity agency and the Health Ministry are investigating. No one has been named, and no group has claimed responsibility. The AP also mentions a separate report of supermarket fridges being warmed in several European countries. It does not say the two are linked.

Some details are still unknown. The AP report does not name the supplier or explain how the attackers got in. Facts may change as the investigation continues.

Why attackers go after equipment and suppliers

This was not an attack on donor records. It went after the machines that keep blood products safe. A cooling controller is a small computer on a network, and it can be changed like any other device.

Suppliers and maintenance contractors often need remote access to monitor this kind of equipment. That access can become a way in if it is weakly protected. Your own network may be well defended while a partner's connection is not.

Ask every vendor with remote access how they protect it. Ask who can log in, from where, and how you would know if something changed.

What this blood bank cyber attack means for Malaysia

Healthcare services are listed among the sectors the Cyber Security Act 2024 treats as national critical information infrastructure, according to law firm CMS. Our Cyber Security Act 2024 guide explains what this means in practice.

Hospitals, clinics, labs, pharmacies and food cold-chain firms all depend on temperature-controlled storage. A controller reachable from the internet with a weak password is a real risk. Our post on Malaysia cyberattack response lessons shows why a fallback plan matters when systems must be switched off.

Five checks to run this week

These steps follow the primary mitigations that CISA publishes for operational technology, meaning the equipment that runs physical processes.

• Remove internet exposure. Take equipment such as cooling controllers off the public internet wherever you can.
• Change default passwords. Use strong, unique passwords on every controller and gateway.
• Secure remote access. Allow vendor access only through protected and monitored routes.
• Separate networks. Keep operational equipment apart from your office IT network.
• Practise manual operation. Know how to run storage by hand and move stock if an alarm fires.

Also make sure alarms reach a person who can act at any hour. That is what limited the damage in France.

How Primary Guard helps

Not sure which of your devices can be reached from the internet? A network penetration test can show what an outsider can reach. Our managed SOC service watches your systems for unusual activity, so an alert reaches a person quickly. Primary Guard offers a free assessment, so request your free assessment to start the conversation.

Frequently asked questions

Can hackers really change fridge settings?

Yes, if the controller can be reached and its settings can be changed. In this case, the EFS reports that thresholds were raised. That is a settings change, not a break-in at the site.

Is this the same group behind the supermarket fridge attacks?

It is not known. No one has claimed responsibility, and the AP does not say the incidents are linked. Treat them as separate until investigators say otherwise.

What should a small clinic do first?

List every device that connects to the internet, including cooling and building systems. Then ask each supplier how they access those devices and who is responsible for updates.

Key takeaway

This blood bank cyber attack was caught by alarms and staff who acted quickly. Review supplier access, passwords and manual fallback plans now, before a similar attempt reaches your own storage.

Sources

AP News, Nov 2026 | CISA, Nov 2026 | CMS Law, Aug 2024

This article is based on public news reports from 4 November 2026 and may change as investigations continue. It is general information, not advice.