French Blood Bank Cold Rooms Targeted via Hacked Refrigeration Provider in Wider European Attack Wave
Three French blood banks under the French Blood Establishment (EFS) detected and reversed a potentially destructive temperature spike in their cold rooms after a cyberattack hit a third-party refrigeration equipment provider on November 2, 2026. The attackers manipulated temperature and defrost thresholds to dangerously high levels, but EFS monitoring and alarm systems caught the anomalies in time, allowing blood and plasma products to be relocated before any samples were damaged. Blood collection and distribution to France's 1,900 healthcare facilities remain unaffected. The incident appears connected to a broader wave of attacks on refrigeration units in European supermarkets across Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, the Netherlands, Portugal, and Romania.
Detalhes técnicos
Security researcher Xavier Bellekens (CEO of Lupovis) reported that starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors, originating from ASNs previously linked to bullet-proof hosting used by Russian adversaries. Most attempts relied on publicly documented factory-default credentials, with probing continuing until October 30, suggesting reconnaissance to compromise as many devices as possible ahead of a coordinated, widespread attack. Attribution for the campaign remains unknown.
Remediação
EFS is working with the French National Cybersecurity Agency (ANSSI) and the Ministry of Health, and has increased monitoring of equipment operation and temperatures across its facilities.
Linha do tempo
-
French Blood Bank Cold Rooms Targeted via Hacked Refrigeration Provider in Wider European Attack Wave
ler a análise desta fonte ocultar
Three French blood banks under the French Blood Establishment (EFS) detected and reversed a potentially destructive temperature spike in their cold rooms after a cyberattack hit a third-party refrigeration equipment provider on November 2, 2026. The attackers manipulated temperature and defrost thresholds to dangerously high levels, but EFS monitoring and alarm systems caught the anomalies in time, allowing blood and plasma products to be relocated before any samples were damaged. Blood collection and distribution to France's 1,900 healthcare facilities remain unaffected. The incident appears connected to a broader wave of attacks on refrigeration units in European supermarkets across Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, the Netherlands, Portugal, and Romania.
Technical Details
Security researcher Xavier Bellekens (CEO of Lupovis) reported that starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors, originating from ASNs previously linked to bullet-proof hosting used by Russian adversaries. Most attempts relied on publicly documented factory-default credentials, with probing continuing until October 30, suggesting reconnaissance to compromise as many devices as possible ahead of a coordinated, widespread attack. Attribution for the campaign remains unknown.
Remediation
EFS is working with the French National Cybersecurity Agency (ANSSI) and the Ministry of Health, and has increased monitoring of equipment operation and temperatures across its facilities.