Attackers Manipulate Refrigeration Controls at French Blood Supply Facilities
French authorities are investigating a cyberattack in which an unknown hacker remotely manipulated temperature and defrosting controls at cold storage rooms serving three sites of the French Blood Establishment (EFS), the agency overseeing France's civilian blood supply. The intrusion raised storage temperatures and defrost thresholds to dangerous levels, threatening plasma intended for transfusions and for pharmaceutical fractionation. EFS monitoring systems detected the anomaly in time, staff regained control, and supplies were relocated before integrity was compromised. The incident follows a wave of similar attacks in October that hit hundreds of French supermarkets and grocery chains across multiple European countries by forcing refrigeration units into superheated defrost cycles, spoiling millions of dollars of food, and is echoed by reported 'outages' at several U.S. military commissaries now under investigation.
Entenda a falha
A vulnerabilidade
No CVE is listed for this story. ANSSI says Danfoss AK-SM and AK-SC controllers, plus Copeland xweb and Dixell xweb refrigeration controllers, were compromised, and it issued guidance on vulnerabilities in these devices. Thousands remain reachable directly from the internet. In August, Claroty reported critical flaws in Danfoss controllers that could allow remote code execution and manipulation of functions such as temperature. The articles do not give affected or fixed versions, and they only say the attacks are consistent with those flaws, not that they were confirmed as the entry point. With network reach to an exposed device, the attacker changed temperature and defrost settings.
Como funciona
These controllers run cold rooms and refrigerated cases, holding temperature setpoints and defrost thresholds. When one is reachable from the internet, a remote party can send it commands over the network. In these incidents the attacker raised storage temperatures and defrost thresholds to very high levels, or forced units into superheated defrost cycles. The controller applies the new values as if they were legitimate, so the cold room warms up. At the French blood sites, EFS monitoring and alarms flagged the abnormal readings and staff took back control.
Por que é vulnerável
The main cause the articles point to is exposure: thousands of these controllers are directly reachable from the internet, so anyone can try to interact with their management functions. Claroty's August report on Danfoss controllers describes critical flaws allowing remote code execution, but the articles do not explain their root cause or what fixes change. ANSSI's guidance urges removing the controllers from direct internet exposure.
Como foi descoberta
The blood-supply intrusion was detected by EFS monitoring systems and alarms, which let staff regain control. ANSSI says it has been investigating since the mid-October incidents at French supermarkets, which were followed by attacks on grocery stores in several European countries. U.S. military commissary outages are also under investigation. Separately, Claroty published its report on critical Danfoss controller flaws in August. Health-ISAC sent an advisory to its members about the risk.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 15:45.
Detalhes técnicos
ANSSI confirmed the compromises involve exposed Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb refrigeration controllers. Thousands of these devices remain accessible directly from the internet, making them visible and reachable to attackers. In August, researchers at Claroty published findings on critical vulnerabilities in Danfoss controllers that could allow remote code execution, enabling attackers to manipulate key functions including temperature settings — flaws consistent with the exploitation pattern seen in this campaign.
Remediação
ANSSI is coordinating preventive and remediation measures with EFS, the Ministry of Health, and other potentially impacted industries, and has issued guidance urging organizations to remove these refrigeration controllers from direct internet exposure. In the U.S., the Health Information Sharing and Analysis Center (Health-ISAC) issued an advisory warning members of the potential risk to similarly exposed cold-chain infrastructure.
Linha do tempo
-
Attackers Manipulate Refrigeration Controls at French Blood Supply Facilities
ler a análise desta fonte ocultar
French authorities are investigating a cyberattack in which an unknown hacker remotely manipulated temperature and defrosting controls at cold storage rooms serving three sites of the French Blood Establishment (EFS), the agency overseeing France's civilian blood supply. The intrusion raised storage temperatures and defrost thresholds to dangerous levels, threatening plasma intended for transfusions and for pharmaceutical fractionation. EFS monitoring systems detected the anomaly in time, staff regained control, and supplies were relocated before integrity was compromised. The incident follows a wave of similar attacks in October that hit hundreds of French supermarkets and grocery chains across multiple European countries by forcing refrigeration units into superheated defrost cycles, spoiling millions of dollars of food, and is echoed by reported 'outages' at several U.S. military commissaries now under investigation.
Technical Details
ANSSI confirmed the compromises involve exposed Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb refrigeration controllers. Thousands of these devices remain accessible directly from the internet, making them visible and reachable to attackers. In August, researchers at Claroty published findings on critical vulnerabilities in Danfoss controllers that could allow remote code execution, enabling attackers to manipulate key functions including temperature settings — flaws consistent with the exploitation pattern seen in this campaign.
Remediation
ANSSI is coordinating preventive and remediation measures with EFS, the Ministry of Health, and other potentially impacted industries, and has issued guidance urging organizations to remove these refrigeration controllers from direct internet exposure. In the U.S., the Health Information Sharing and Analysis Center (Health-ISAC) issued an advisory warning members of the potential risk to similarly exposed cold-chain infrastructure.