Coolworld refrigeration supplier hack hits French blood service (EFS) cold rooms: setpoints changed from -30°C to 110°C, no products lost
Matéria consolidada. Reúne 7 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 7 fontes trouxeram em 05/11/2026 00:07; os links antigos trazem para cá.
Fontes: olhardigital.com.br ↗ securityaffairs.com ↗ bleepingcomputer.com ↗ helpnetsecurity.com ↗ infosecurity-magazine.com ↗ theregister.com ↗ gbhackers.com ↗
A cyberattack on Coolworld (reported as Coolworld Rentals by bleepingcomputer.com), a refrigeration equipment and maintenance supplier to France's Établissement français du sang (EFS), led to unauthorized changes to cold-room temperature and defrost settings at three EFS facilities in Bourgogne-Franche-Comté on November 2, 2026, with some outlets dating the activity to the night of November 1-2 (helpnetsecurity.com, bleepingcomputer.com, gbhackers.com). Setpoints were reportedly raised from about -30°C to 110°C (gbhackers.com, infosecurity-magazine.com). EFS monitoring and alarms, and an on-call technician, caught the anomaly in time. Staff repaired or isolated equipment and moved blood samples and frozen plasma to other sites, so no products were lost and no health impact was reported (theregister.com, bleepingcomputer.com). EFS was not directly targeted and no EFS IT systems are believed to be affected (infosecurity-magazine.com). EFS has notified ANSSI and the Ministry of Health and has increased monitoring. The incident appears to belong to a wider Europe-wide wave of attacks on refrigeration controllers, but the initial access vector, the attacker and the exact products involved remain unconfirmed.
Entenda a falha
A vulnerabilidade
The articles do not name the flaw. Coolworld (reported as Coolworld Rentals by BleepingComputer) says the attackers exploited a vulnerability in a third-party component of its remote monitoring software, outside its direct control, and that only a limited number of its units were affected. The attackers changed temperature and defrost thresholds at three EFS facilities on November 2, 2026. Sabcobel says the November supermarket attacks used the same vulnerability as the October French ones. CVE-2025-41450 and CVE-2025-41451 (Danfoss AK-SM 8xxA, authentication bypass and remote command execution) are context only, and no article confirms they are involved. Affected and fixed versions are not given.
Como funciona
The articles give only a partial picture. The refrigeration units are managed through remote monitoring software that lets the provider view and change settings on cold-storage chambers. The attackers reached this remote management path through the flawed third-party component. They then set the temperature setpoint and defrost thresholds to extreme values (reportedly 110°C instead of about -30°C). A setpoint is only an instruction to the controller, not proof that the chamber reached that temperature. Alarms and an on-call technician caught the change, and remote access was disabled. The articles do not describe the exact step where the component fails.
Por que é vulnerável
The root cause is not stated. Coolworld only says the vulnerability lies in a component from a third-party supplier. The wider refrigeration campaign shows a pattern: internet-reachable controllers and remote maintenance access that let someone change settings. Lupovis saw attempts using publicly documented factory-default credentials against Danfoss AK-SM sensors, but no article links default credentials to the EFS incident. No fix is described beyond unspecified Coolworld mitigations.
Como foi descoberta
The flaw came to light through exploitation in the wild, not through research. Le Canard enchaîné reported the attack on November 3 after an on-call technician noticed abnormal temperature rises. EFS published a statement the same day saying its refrigeration supplier was hit, and Coolworld confirmed the incident on November 4. EFS notified ANSSI and the Ministry of Health. The articles do not say who found the flaw or how it was reported to the vendor. Researcher Xavier Bellekens (Lupovis) reported authentication attempts against Danfoss AK-SM sensors from October 20 to 30, which he reads as preparation for a coordinated attack. Whether the EFS incident used the same route as the supermarket attacks is unclear, and the attacker is unknown.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:22.
Detalhes técnicos
- Access path: Attackers exploited a vulnerability in a third-party component used by Coolworld's remote monitoring/control software (bleepingcomputer.com, infosecurity-magazine.com). Coolworld says this component is outside its direct control. This is a supply-chain pattern, since one maintenance provider can change setpoints across several client environments (olhardigital.com.br). Coolworld is a Dutch temperature-control provider that also operates in Germany, Ireland, the Netherlands and the UK (infosecurity-magazine.com).
- What changed: The key evidence is a malicious setpoint and defrost-threshold change. Real product temperatures and exposure duration have not been disclosed, so it is not confirmed that storage compartments or plasma bags actually reached 110°C (gbhackers.com).
- Containment: Remote access to the affected systems was disabled and products were moved to unconnected refrigerators (securityaffairs.com).
- Related campaign: The method matches earlier compromises of Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which were used to trigger defrost cycles and raise temperatures (bleepingcomputer.com, theregister.com). A CERT-FR advisory urged remediation of the Danfoss systems (theregister.com). Whether the EFS incident used the same route is unclear. gbhackers.com cites ANSSI warnings about these controllers but notes no evidence that they were used at the EFS sites.
- Prior reconnaissance: Researcher Xavier Bellekens (Lupovis CEO) reported authentication attempts against Danfoss AK-SM sensors from October 20 to October 30, 2026. They came from ASNs previously linked to bullet-proof hosting used by Russian adversaries and mostly used publicly documented factory-default credentials. He suggests this was reconnaissance ahead of a coordinated attack (helpnetsecurity.com). Attribution remains unknown.
- CVEs: CVE-2025-41450 and CVE-2025-41451, previously disclosed by CISA for Danfoss AK-SM 8xxA controllers, are not confirmed to be involved. Belgian firm Sabcobel said the November supermarket attacks used the same vulnerability as the October French incidents (bleepingcomputer.com).
- Wider wave: Retailers in Belgium, Ireland, Luxembourg, Sweden, Estonia, Finland, Germany, Portugal, Romania and the Netherlands reported remotely triggered defrost cycles, with temperatures reaching 50°C (theregister.com). A month earlier, French chains including Carrefour, Coopérative U, Intermarché and Monoprix were hit, and US military commissaries were affected in August (theregister.com). The UK NCSC chief confirmed some impact on the UK food supply chain, and ANSSI director Vincent Strubel had warned about refrigeration infrastructure as a target (olhardigital.com.br).
Remediação
- EFS has strengthened monitoring of equipment operation and temperatures and is working with ANSSI and the Ministry of Health (helpnetsecurity.com, bleepingcomputer.com).
- Coolworld says it applied unspecified mitigation measures and is working with affected customers (infosecurity-magazine.com, bleepingcomputer.com).
- Recommended defender actions:
- Identify and reduce exposed OT/ICS and building-control interfaces.
- Restrict and strongly authenticate remote access and vendor maintenance connections, and change factory-default credentials.
- Segment OT from corporate IT.
- Monitor for unauthorized configuration changes.
- Run independent temperature monitoring separate from vendor-controlled systems, with tested alarm and escalation procedures.
- Keep manual fallback procedures, and verify actual product conditions rather than relying on controller setpoints (securityaffairs.com, gbhackers.com).
Relatos divergentes
- Scope of affected products: gbhackers.com says EFS first said only donor samples used for transfusion monitoring were affected, then clarified that frozen plasma for patients was also involved. Other sources say no blood products or plasma were lost (theregister.com, infosecurity-magazine.com, bleepingcomputer.com).
- Number of facilities: helpnetsecurity.com, bleepingcomputer.com and securityaffairs.com report three facilities. olhardigital.com.br, an earlier-published and less detailed source, says the number is undisclosed.
- Nature of the effect: securityaffairs.com describes disrupted monitoring and control of cold storage, while most others describe altered temperature and defrost settings. The more detailed reports from bleepingcomputer.com and helpnetsecurity.com support the setpoint-manipulation account.
- Initial access: gbhackers.com says the vector has not been publicly identified. Later reports from infosecurity-magazine.com and bleepingcomputer.com, citing Coolworld and EFS, attribute it to a vulnerable third-party component in the remote monitoring software.
- Dates: Sources variously give November 1-2 (gbhackers.com, infosecurity-magazine.com, olhardigital.com.br) or November 2 (helpnetsecurity.com, bleepingcomputer.com).
- Countries affected by the supermarket wave: The lists differ between sources (for example, theregister.com includes Finland, Germany, Portugal and Romania, while bleepingcomputer.com and gbhackers.com give shorter lists).
Linha do tempo
-
Attack on Cooling Systems Threatens French Blood Plasma Storage via Third-Party Maintenance Provider
ler a análise desta fonte ocultar
Between November 1-2, 2026, attackers compromised refrigeration control systems supplied by Coolworld, a maintenance vendor for the French Blood Establishment (EFS), which manages blood and plasma collection, storage and distribution in France. The intruders reprogrammed freezer temperature settings from -30°C to 110°C, threatening frozen plasma stocks used in transfusions and surgeries. The French Ministry of Health stated the incident caused no major operational impact, as the temperature changes were detected and corrected quickly; the number of affected facilities, outage duration, actual temperatures reached, and whether any blood stock was discarded remain undisclosed. The attack did not directly breach medical facilities but exploited third-party maintenance infrastructure that manages refrigeration across multiple clients, illustrating a supply-chain risk pattern. It follows similar attacks on supermarket freezers in Europe weeks earlier and warnings from ANSSI director Vincent Strubel about refrigeration infrastructure as a target.
Technical Details
According to the site Cyberattaque (cited by Cyber Security News), attackers did not target EFS directly but compromised the third-party maintenance systems operated by Coolworld that control freezer temperatures, allowing them to alter setpoints remotely across potentially multiple client environments.
Remediation
No specific remediation guidance was disclosed. UK NCSC chief Richard Horne, presenting the State of the Cyber Nation report, separately warned of fragile infrastructure across electricity distribution, water/dam controls, industrial production lines, and refrigeration controls, describing the UK's cyber posture as a "digital Leaning Tower of Pisa" and warning of a potential unprecedented rise in incidents.
-
Cyberattack Disrupts Cold-Storage Monitoring at French Blood Banks Amid Europe-Wide Refrigeration Attacks
ler a análise desta fonte ocultar
A cyberattack struck three regional facilities of the French Blood Establishment (EFS) overnight, disrupting monitoring and control systems for refrigerated blood storage. The French Health Ministry confirmed the incident impacted cold storage room monitoring but stated blood supplies were not affected, as staff moved products to unconnected refrigerators and remote access to compromised systems was disabled. The attack coincided with similar incidents targeting supermarket refrigeration systems across eight European countries, including Sweden and Belgium, forcing retailers to discard food after cooling systems were interfered with. This follows an October incident in which hackers reportedly seized control of cooling units at hundreds of French supermarkets, causing fires and food losses. The incidents highlight growing exposure of operational technology (OT) and remote management platforms connected to corporate networks.
Technical Details
The affected systems were cold storage room monitoring and control platforms at EFS facilities; remote access to the impacted refrigerators was disabled as a containment measure. Investigations are ongoing to determine the initial access method, scope of affected equipment, and timeline for restoring normal operations. No attacker attribution or specific malware/TTPs have been disclosed.
Remediation
The article recommends organizations operating connected OT/ICS equipment identify exposed systems, restrict and strongly authenticate remote access, segment operational networks from corporate IT, monitor for unauthorized configuration changes, and maintain tested manual fallback procedures for essential services when digital systems are unavailable or untrustworthy.
-
Cyberattack on Refrigeration Supplier Disrupts Blood Storage Cooling at France's EFS
ler a análise desta fonte ocultar
France's national blood service, Établissement français du sang (EFS), confirmed that a cyberattack on its refrigeration equipment supplier Coolworld Rentals raised temperature and defrost settings at three EFS facilities on November 2, 2026, threatening stored blood products. EFS itself was not directly targeted; attackers exploited a vulnerability in a third-party component used by Coolworld's remote monitoring software. EFS detected the anomaly quickly via its monitoring and alarm systems, allowing staff to repair affected equipment or transfer blood products and plasma to other facilities, with no reported health impact or loss of blood products. The incident is part of a broader wave of attacks on European refrigeration systems, following October and November campaigns that disrupted hundreds of supermarkets across France, Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.
Technical Details
Attackers manipulated temperature and defrost thresholds remotely, a technique matching prior incidents where hackers compromised Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers to trigger defrost functions and raise temperatures. Belgian firm Sabcobel has said the November supermarket attacks exploited the same vulnerability as the October French incidents, though it remains unconfirmed whether CVE-2025-41450 and CVE-2025-41451, previously disclosed by CISA for Danfoss AK-SM 8xxA controllers, are involved in this specific EFS/Coolworld incident.
Remediation
EFS has strengthened monitoring of refrigeration equipment and temperatures and is working with France's ANSSI and the Ministry of Health. Coolworld says it responded promptly, is working with affected customers, and the vulnerability involved a third-party component outside its direct control.
-
French Blood Bank Cold Rooms Targeted via Hacked Refrigeration Provider in Wider European Attack Wave
ler a análise desta fonte ocultar
Three French blood banks under the French Blood Establishment (EFS) detected and reversed a potentially destructive temperature spike in their cold rooms after a cyberattack hit a third-party refrigeration equipment provider on November 2, 2026. The attackers manipulated temperature and defrost thresholds to dangerously high levels, but EFS monitoring and alarm systems caught the anomalies in time, allowing blood and plasma products to be relocated before any samples were damaged. Blood collection and distribution to France's 1,900 healthcare facilities remain unaffected. The incident appears connected to a broader wave of attacks on refrigeration units in European supermarkets across Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, the Netherlands, Portugal, and Romania.
Technical Details
Security researcher Xavier Bellekens (CEO of Lupovis) reported that starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors, originating from ASNs previously linked to bullet-proof hosting used by Russian adversaries. Most attempts relied on publicly documented factory-default credentials, with probing continuing until October 30, suggesting reconnaissance to compromise as many devices as possible ahead of a coordinated, widespread attack. Attribution for the campaign remains unknown.
Remediation
EFS is working with the French National Cybersecurity Agency (ANSSI) and the Ministry of Health, and has increased monitoring of equipment operation and temperatures across its facilities.
-
Refrigeration Cyber-Attack Spikes French Blood Service Cold Storage to 110°C
ler a análise desta fonte ocultar
France's National Blood Service (EFS) had cold storage rooms in its Burgundy and Franche-Comté facilities sabotaged by unauthorized actors overnight between November 1-2, 2026, causing temperatures to spike from a normal -30°C to as high as 110°C. The incident, part of a wider wave of attacks on refrigeration control systems across France reported by Le Canard enchaîné, targeted equipment maintained by Dutch temperature-control provider Coolworld, which also operates in Germany, Ireland, the Netherlands and the UK. An on-call technician detected the abnormal temperature rise in time, preventing any loss of blood samples or plasma intended for patient transfusions. Coolworld confirmed the incident, stating only a limited number of its units were affected and attributing the vulnerability to a third-party component not directly controlled by the company.
Technical Details
The attack compromised remote monitoring/control software used in refrigeration systems rather than EFS's own IT infrastructure; no EFS IT systems are currently believed to be impacted. The incident follows related attacks on refrigeration controllers at major French supermarket chains and a broader pattern of internet-exposed Danfoss controllers being targeted across Europe, suggesting a campaign against internet-facing industrial refrigeration/HVAC control systems rather than a targeted attack on EFS specifically.
Remediation
Coolworld stated it implemented unspecified mitigation measures after becoming aware of the incident. The French Ministry of Health confirmed no operational disruption occurred due to timely detection by on-site staff.
-
Cyberattack Hits French Blood Service Supplier, Tampers With Cold-Storage Settings
ler a análise desta fonte ocultar
The French Blood Establishment (EFS) confirmed that a cyberattack compromised one of its refrigeration equipment suppliers, resulting in unauthorized changes to cold-room temperature settings used to store blood samples and frozen plasma. Attackers reportedly altered settings from -30°C to 110°C, but EFS's monitoring and alarm systems detected the anomalies in time, allowing affected equipment to be isolated or neutralized and stored products to be preventively relocated to other facilities. No blood products or samples were lost. EFS notified ANSSI (France's cybersecurity agency) and the Ministry of Health, and did not publicly name the compromised supplier.
This incident follows a broader wave of refrigeration-targeting cyberattacks across Europe, where retailers in Belgium, Ireland, Luxembourg, Sweden, Estonia, Finland, Germany, Portugal, Romania and the Netherlands reported remotely triggered defrost cycles causing spoilage, with temperatures reaching 50°C. The UK's NCSC chief confirmed some impact on the UK food supply chain, with meat suppliers reporting affected fridges. A separate wave a month earlier hit French supermarket chains including Carrefour, Coopérative U, Intermarché and Monoprix, and US military commissaries were also affected in August. Some victims identified Danfoss AK-SM/AK-SC controllers in their environments, prompting a CERT-FR advisory urging remediation of vulnerabilities in these systems, though it remains unclear if the EFS incident used the same access route.
-
Attackers Manipulate Refrigeration Controls at French Blood Service Supplier Coolworld, Setting Freezers to 110°C
ler a análise desta fonte ocultar
Between November 1–2, 2026, hackers reportedly compromised refrigeration equipment operated by Coolworld, a contractor serving France's Établissement Français du Sang (EFS), altering freezer setpoints from roughly -30°C to 110°C. The attack affected facilities in Bourgogne-Franche-Comté and was first reported by Le Canard enchaîné on November 3 after an on-call technician noticed abnormal temperature readings. France's Health Ministry said technicians intervened in time to prevent major operational disruption. EFS initially said only donor samples used for transfusion monitoring were affected, later clarifying that frozen plasma intended for patient transfusions was also involved.
Technical Details
The incident centers on a malicious setpoint change—a controller instruction for desired temperature—rather than confirmed proof that storage compartments or plasma bags actually reached 110°C; neither real product temperatures nor exposure duration have been disclosed. Investigators have not publicly identified the initial access vector, exploited vulnerability, controller models, or threat actor. The attack resembles earlier incidents against French supermarket refrigeration systems where intruders abused automatic defrost functions to cause prolonged heating, though a technical link to the Coolworld intrusion is unproven. A broader European refrigeration sabotage report cited similar incidents in Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands, referencing ANSSI warnings about Danfoss AK-SM, AK-SC, Copeland, and Dixell XWEB controllers, though no evidence confirms these products were used at the affected EFS facilities. No confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft has been reported.
Remediation
Healthcare operators and refrigeration contractors should limit exposed interfaces on OT/building control systems, restrict and monitor remote maintenance connectivity, enforce independent temperature monitoring separate from vendor-controlled systems, and ensure alarm and escalation procedures detect dangerous deviations before stored medical products are compromised. Verification of actual product conditions, rather than reliance on controller setpoints alone, is essential when assessing suspected cold-chain interruptions.