Cyberattack Attempts to Spike Temperatures at French Blood Bank Cold-Storage Sites via Refrigeration Supplier
A cyberattack targeted refrigeration equipment at three cold-storage sites of the French Blood Establishment (EFS), attempting to raise plasma storage temperatures from minus 30°C to as high as 110°C. Monitoring systems detected the anomaly in time, and no blood products or samples were compromised, according to EFS. The attack reached EFS through a vulnerability in equipment supplied by refrigeration company Coolworld, which said the issue stemmed from a third-party component outside its direct control and affected only a limited number of units. France's national cybersecurity agency (ANSSI) and the Health Ministry are investigating. This incident follows a mid-October wave of attacks on supermarket fridges and freezers in France, Belgium and the Netherlands, which caused significant food spoilage, including at Ahold Delhaize, which now expects up to €250 million in lost Q4 sales and €100 million in reduced operating income.
Entenda a falha
A vulnerabilidade
No CVE has been assigned and the articles give no technical detail. A vulnerability in a third-party component built into refrigeration equipment from Coolworld was used to raise the temperature and defrosting thresholds on cold-storage units at three French Blood Establishment (EFS) plasma sites. Coolworld says only a limited number of units are affected. The articles do not say what access the attacker needed, nor which versions are affected or fixed. Coolworld only says it is taking "appropriate measures".
Como funciona
The articles do not describe how the vulnerable component works. What they report is the outcome: the attacker changed the temperature and defrosting thresholds on the cold-storage units, trying to push plasma storage from about minus 30°C to as high as 110°C, according to Le Canard Enchaîné. EFS monitoring systems detected the anomaly quickly, and staff moved or secured the products in time.
Por que é vulnerável
The root cause is not disclosed. Coolworld only says the flaw lies in a component from a third-party supplier that was outside its direct control, not in its own systems. The articles do not say what kind of weakness it is or what the fix changes.
Como foi descoberta
The flaw came to light through the attack itself. EFS said the thresholds were raised on Monday at three sites and published a statement late Tuesday. Le Canard Enchaîné reported the incident first. Coolworld confirmed it was aware of the incident and said the vulnerability, as reported in the media, relates to a third-party component. France's national cybersecurity agency (ANSSI) and the Health Ministry are investigating. The attack resembles a mid-October wave that hit fridges and freezers at supermarkets in France, Belgium and the Netherlands, but the articles do not confirm they share the same flaw or the same attacker.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 12:16.
Detalhes técnicos
The attack manipulated temperature and defrosting thresholds on cold-storage units used for blood plasma intended for transfusions and pharmaceutical manufacturing. The compromise was traced to a vulnerability in a component from a third-party supplier integrated into Coolworld's refrigeration equipment, rather than a direct flaw in Coolworld's own systems.
Remediação
EFS staff transferred or secured affected plasma products after detection, and blood collection and distribution operations continued uninterrupted. Coolworld stated it is taking unspecified 'appropriate measures' to address the vulnerability.
Linha do tempo
-
Cyberattack Attempts to Spike Temperatures at French Blood Bank Cold-Storage Sites via Refrigeration Supplier
ler a análise desta fonte ocultar
A cyberattack targeted refrigeration equipment at three cold-storage sites of the French Blood Establishment (EFS), attempting to raise plasma storage temperatures from minus 30°C to as high as 110°C. Monitoring systems detected the anomaly in time, and no blood products or samples were compromised, according to EFS. The attack reached EFS through a vulnerability in equipment supplied by refrigeration company Coolworld, which said the issue stemmed from a third-party component outside its direct control and affected only a limited number of units. France's national cybersecurity agency (ANSSI) and the Health Ministry are investigating. This incident follows a mid-October wave of attacks on supermarket fridges and freezers in France, Belgium and the Netherlands, which caused significant food spoilage, including at Ahold Delhaize, which now expects up to €250 million in lost Q4 sales and €100 million in reduced operating income.
Technical Details
The attack manipulated temperature and defrosting thresholds on cold-storage units used for blood plasma intended for transfusions and pharmaceutical manufacturing. The compromise was traced to a vulnerability in a component from a third-party supplier integrated into Coolworld's refrigeration equipment, rather than a direct flaw in Coolworld's own systems.
Remediation
EFS staff transferred or secured affected plasma products after detection, and blood collection and distribution operations continued uninterrupted. Coolworld stated it is taking unspecified 'appropriate measures' to address the vulnerability.