The organization confirmed the incident on Tuesday and said its own systems were not directly targeted.
The affected equipment held blood samples and frozen plasma, including plasma intended for transfusion.
Reports say the attackers changed cold-room temperature settings from -30°C to 110°C, though that does not mean the equipment or its contents actually reached that temperature.
Depending on the situation, affected equipment was either brought back under control or taken out of service, and stored products were moved preventively to other facilities.
The case shows how an attack on a supplier can reach the physical equipment that protects medical supplies.
The organization notified France's cybersecurity agency, ANSSI, and the Ministry of Health, and it has not publicly named the supplier.
The incident follows a wider run of attacks on refrigeration controls. Retailers in Belgium, Ireland, Luxembourg and Sweden first reported remotely triggered defrost cycles, with temperatures reportedly as high as 50°C, forcing them to discard spoiled food. Cases have since been confirmed in Estonia, Finland, Germany, Portugal, Romania and the Netherlands. In the UK, National Cyber Security Centre chief executive Richard Horne said he knew of "a couple of impacts" in the food supply chain, and the British Association of Independent Meat Suppliers said some members were "collateral" victims. An earlier wave a month ago hit French chains including Carrefour and Intermarché. It is unclear whether the EFS attack used the same route. Some chains identified Danfoss controllers, and France's CERT-FR urged organizations to fix vulnerabilities in Danfoss AK-SM and AK-SC controllers, while others said they did not use that equipment. The attackers have not been identified.