Hackers tampered with the refrigeration controls of cold rooms used by France's national blood service, the Établissement français du sang (EFS), overnight from Sunday, November 1 to Monday, November 2, 2026. Cold rooms normally kept at around -30°C were given a new setpoint of 110°C (230°F), according to French weekly Le Canard enchaîné, which broke the story. The EFS says alarms and an on-call technician caught the anomaly in time. No blood products were lost and no health impact has been identified. The incident landed during the same night as the second wave of attacks on supermarket fridges across Europe.
What happened
The EFS said monitoring and control systems for cold rooms at three of its sites were hit, with temperature and defrost thresholds "raised to very high levels." Le Canard enchaîné reported that affected facilities include sites in the Bourgogne-Franche-Comté region. The EFS says the 110°C setpoint was never actually reached.
The cold rooms held donor samples kept for health surveillance, but also bags of frozen plasma meant for transfusion or for fractionation into medicines. EFS president Frédéric Pacoud told BFMTV that the service "could have lost samples or bags of plasma intended to treat patients," but that "there was no compromise to the safety of blood products."
The affected units were either brought under control or neutralized, and their contents were moved to other facilities as a precaution. Remote access to the affected equipment was cut off, according to the office of Health Minister Stéphanie Rist. Blood collection and distribution carried on as normal.
A supplier, not the EFS, was the way in
French media identified the refrigeration supplier as Coolworld, which Infosecurity Magazine describes as a Dutch temperature-control rental company operating in France, Germany, Ireland, the Netherlands and the UK. The EFS told Politico it was not the direct target, and Infosecurity Magazine reports nothing so far suggests EFS's own IT systems were affected.
In a statement, Coolworld said it was aware of "the cybersecurity incident involving remote monitoring software used in refrigeration systems," that only a "limited number" of its units were affected, and that "the vulnerability currently being reported in the media concerns a component supplied by a third-party provider and not directly controlled by Coolworld." The company did not name that component or the measures it took.
How it fits the European fridge attacks
The blood bank incident appears tied to the wave of attacks that pushed supermarket refrigeration into defrost or heating mode across Europe on the same night, Politico reports. Those attacks followed the October 11-12 wave on French supermarkets. In that wave, the targeted controllers included end-of-life units that no longer get security patches. IT Pro notes it hasn't been confirmed whether the same is true this time. CERT-FR (ANSSI) has warned since October 12 about attacks on remote refrigeration controllers, covering Danfoss, Copeland and Dixell gear. It recommends removing their management interfaces from the internet, securing remote access, checking setpoints and defrost ranges, and installing available updates. No one has publicly linked a specific product or CVE to the EFS incident.
Still under investigation
The EFS says its teams are working with ANSSI and the Ministry of Health and have stepped up temperature monitoring across all of its equipment. The minister's office says investigations are still trying to establish the attackers' method, the total number of equipment potentially involved, and when the affected installations can return to service. No group has claimed responsibility.
What to do: healthcare and cold-chain operators
- Inventory every connected refrigeration and temperature-monitoring system, including units owned, rented or remotely managed by contractors.
- Ask suppliers which remote-monitoring components their equipment uses and how those components are reached from the internet.
- Take management interfaces off the public internet. Allow remote access only through a secured VPN or protected network.
- Set alerts on setpoint, defrost and login changes, independent of the vendor's platform. In this case, the EFS's own alarms and on-call staff made the difference.
- Have a tested plan for moving products to backup cold storage quickly.
- Follow CERT-FR's refrigeration controller guidance (CERTFR-2026-ALE-012) and apply firmware updates. Replace end-of-life controllers.
Related reading: European Supermarkets Rush to Lock Down Fridge Controllers After Second Wave of Hacks
Sources
- The420.in: Hackers Reprogram French Blood Bank Chillers from Minus 30 to 110 Degrees
- Infosecurity Magazine: France Blood Service Hack Sends Blood Storage Temperatures to 110°C
- Politico Europe: Fridge hacks also hit French blood banks
- franceinfo: Une cyberattaque touche des chambres froides utilisées par l'EFS
- Sud Ouest: Des chambres froides stockant des dons du sang piratées
- IT Pro: French blood service hit by cyber attack
Featured image: Security Breaches original graphic.
0 Comments