Blood banks hit by cyberattack: *how France's 24-hour rule works*

What happened

On 2 November, three French blood banks were hit by a cyberattack that forced some of them to switch to manual procedures for handling donations ^[1]. The attack targeted the systems blood banks use to manage donor information and blood products.

It's the kind of incident that has real consequences: healthcare relies on blood banks working smoothly, and any disruption can affect patient care. The attackers haven't been identified publicly, and the full extent of the damage isn't known yet.

What we do know is that the attack hit infrastructure covered by Europe's cybersecurity rules, which now apply across the healthcare sector.

How the reporting rules work

Under the EU's NIS2 directive, essential and important entities in 18 sectors must report significant incidents ^[2]. Sweden's cybersecurity law, which implements NIS2, came into force on 15 January 2026 ^[3].

The reporting happens in three steps:

1. An early warning within 24 hours of becoming aware of the incident.
2. A full incident notification within 72 hours.
3. A final report within one month.

The clock starts when you detect the incident, not when you've gathered every detail. It's like when you lose your bank card: you report it straight away, even if you don't yet know whether anyone's used it.

That first 24-hour deadline is tight. In practice, it means someone has to be watching for incidents, and there has to be a process for deciding when something counts as significant and who escalates it.

Why the timeline matters

If a supervisor later asks why the early warning went out after 30 hours instead of 24, the question isn't whether you had all the facts. The question is when you knew enough to know you had an incident.

A sealed record of each step makes that a short conversation. You seal the first detection note when it's written, the decision to escalate when it's made, and each report as it's sent. Anyone you share those records with can check that they haven't changed since.

What it doesn't do is show that the report was complete or that your response was adequate. It just shows when each step was recorded, in a way nobody can quietly rewrite afterwards.

Healthcare's extra layer

Healthcare adds another reporting duty. If patient data is compromised, you also have to report to the data protection authority under GDPR ^[4]. The two duties overlap but aren't identical: one is about operational resilience, the other about personal data.

For a blood bank, that means two supervisors may ask questions, and both will want to know when you knew what.

How a digital witness fits here

The thing to seal is each step of your incident timeline: the first detection note, the decision to escalate, and each report as it is sent. Sealing takes a fingerprint, not the data, so the report itself never leaves your systems.

You seal through the REST API, the SDK or the MCP server, and get a witness ID back. To check, anyone you share the record with calculates the fingerprint again and compares it with the sealed one.

What it shows is when each step was recorded, unchanged since it was sealed. What it doesn't show is that the report was complete or that the response was adequate. It just gives you a timeline that holds up when a supervisor asks how long it took you to report.

The first 2,000 witnesses a month are free. WitniumChain runs the sealing, and the documentation explains how to integrate it.

What this means for you

If you run a healthcare organisation, or any other essential or important entity under NIS2, ask yourself:

• Do we have a process for deciding when an event becomes an incident?
• Who has the authority to escalate, and can they do it outside office hours?
• Could we show, if asked, when we first detected an incident and when we sent each report?

The rules assume you have systems that can answer those questions. A sealed timeline is one way to make sure you can.

What to watch

Sweden's cybersecurity law has been in force since 15 January 2026 ^[3]. The Swedish Civil Contingencies Agency (MSB) supervises most sectors, and the financial and telecom sectors have their own supervisors.

If you're in one of the 18 sectors covered by the law, the clock is already running.

Sources