Insights Cyber resilience
CYBER DISRUPTION / LESSONS FROM REAL INCIDENTS
The controls changed. The alarms gave staff time to act.
On 2 November 2026, a cyberattack on a refrigeration supplier reached equipment at three French blood-service sites. Monitoring picked up changes to the controls. Staff secured or moved the plasma, and the blood service reported no products lost.
Explore the findings- Supplier equipment
Connected refrigeration served three French blood-service sites.
- Controls changed
Temperature and defrost thresholds were raised.
- Monitoring alerted staff
Alarms identified the anomalies.
- Staff intervened
Teams secured or transferred plasma.
- Products protected
EFS reported zero blood-product losses.
EFS said collection and distribution continued. Sequence based on its public account.
What happened
A supplier’s equipment was targeted. The service kept operating.
In early November 2026 an incident affected refrigeration equipment provided to three Établissement français du sang sites. Temperature controls were altered. The public account describes a supplier-related exposure, not a confirmed breach of the blood service’s core network.
The issue was detected and products were transferred or secured. EFS reported no blood-product losses and said collection and distribution continued. The lesson applies beyond refrigeration: a dependency outside your control can affect your operations, but detecting trouble gives people a chance to intervene.
A supplier may operate the equipment, while your team owns the operational consequences. Agree who sees an alert, who can verify it locally and who can authorise a safe response.
- Controls and conditions
- EFS reported changed thresholds. The public account gives no measured series of product temperatures.
- Intervention and outcome
- Staff acted after the alarms. EFS reported no product losses and continued collection and distribution.
Minimum operations
Enough working safely while the rest is restored.
The NCSC calls this minimum viable operations: restoring enough of the essential capabilities to operate safely while a wider rebuild continues. The exact activities depend on the organisation, its obligations and the information people can still trust.
A customer support team might need an authorised way to handle urgent requests before its full case system returns. A finance team might need to make payroll before all reporting is available. Agree what is safe to do and how to record it.
Define the smallest safe workflow with its limits. Document what people can do, where they record it and which decisions must wait for trusted information.
- Minimum safe service
- Handle urgent requests through a verified route. Log decisions and assign an owner. Pause changes that need unavailable records.
- Full service restored
- Reconcile the temporary queue, reconnect the case system and confirm that people can safely complete the normal workflow.
After restoration
Back online isn’t the same as back to normal.
Work doesn’t stop accumulating during an outage. Requests, approvals and changes recorded elsewhere may need to be reconciled with restored records. Without that step, people can repeat completed work or miss an obligation.
Confirm which information is current, which connected services are trustworthy and which decisions were taken while the system was unavailable. That is how a technical restore becomes usable business activity.
Reconciliation needs an owner and a stable reference such as a request ID. Preserve the temporary record until someone has checked the outcome and resolved any conflict.
Request appears open in the backup.
Team recorded a completed call and approval.
Match the request ID and approval, record who checked it, then close the request once.
Resilience
Protection, detection and recovery change different parts of the outcome.
Protection helps keep familiar weaknesses from becoming incidents. Detection gives people a chance to intervene. Containment and recovery can limit how much activity is affected and how long the disruption lasts.
Think about the handoffs between these capabilities: who sees a problem, who can make the decision to isolate a service, and who confirms it is safe to start working again.
The handoffs deserve testing. Confirm that the person receiving the alert can reach the person authorised to isolate the affected service and the owner who decides when work can resume.
- ProtectFewer exposed routes
- Check which public services and privileged accounts are reachable.
- DetectEarlier investigation
- Verify that a relevant alert reaches someone who can triage it.
- ContainLess interruption
- Rehearse isolating an account or service while essential work continues.
- RecoverUsable services
- Restore a service and have its owner complete a representative task.
How Assured Digital can help
Talk through what you found
We help teams understand service dependencies and improve protection, monitoring, backup and recovery. Bring a question about a supplier dependency or a business activity you need to keep running.
Ask Matthew a question
Loading the enquiry form…
We use your details to reply to your enquiry. Any additional marketing subscription is separate. Read our privacy notice.