Cyberattack on Refrigeration Supplier Disrupts Blood Storage Cooling at France's EFS
France's national blood service, Établissement français du sang (EFS), confirmed that a cyberattack on its refrigeration equipment supplier Coolworld Rentals raised temperature and defrost settings at three EFS facilities on November 2, 2026, threatening stored blood products. EFS itself was not directly targeted; attackers exploited a vulnerability in a third-party component used by Coolworld's remote monitoring software. EFS detected the anomaly quickly via its monitoring and alarm systems, allowing staff to repair affected equipment or transfer blood products and plasma to other facilities, with no reported health impact or loss of blood products. The incident is part of a broader wave of attacks on European refrigeration systems, following October and November campaigns that disrupted hundreds of supermarkets across France, Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.
Entenda a falha
A vulnerabilidade
The articles do not name the flaw. Coolworld Rentals says attackers exploited a vulnerability in a third-party component of its remote monitoring software, which affected a limited number of its refrigeration units. The attackers then raised temperature and defrost thresholds at three EFS facilities on November 2, 2026. Sabcobel says the November supermarket attacks used the same vulnerability as the October French ones. CVE-2025-41450 and CVE-2025-41451, which CISA disclosed in 2025 for Danfoss AK-SM 8xxA controllers and which allow authentication bypass and remote command execution, are mentioned only as context. It is not confirmed that they are involved. Affected and fixed versions are not given.
Como funciona
The articles give only a partial picture. The refrigeration units are managed through remote monitoring software that lets operators view and change settings on cold-storage chambers. Attackers reached this remote management path by exploiting a flaw in a third-party component. They then changed temperature and defrost thresholds to extremely high levels, which switched off cooling in the affected chambers. EFS monitoring and alarms detected the change quickly. The articles do not describe the exact step where the component fails.
Por que é vulnerável
The root cause is not stated in the articles. Coolworld only says the vulnerability lay in a third-party supplier's component outside its direct control. The related Danfoss CVEs are described as authentication bypass and remote command execution, but the articles do not confirm that they apply here. No fix is described.
Como foi descoberta
The flaw came to light through its exploitation in the wild. EFS published a statement on November 3 saying its refrigeration supplier was hit, and Coolworld then confirmed an incident involving its remote monitoring software. The vulnerability was being reported in the media at the time. EFS says its monitoring and alarm systems detected the temperature change quickly. The articles do not say who found the flaw or how it was reported. Sabcobel links the November attacks to the same vulnerability as the October French supermarket attacks, which reportedly hit Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 16:16.
Detalhes técnicos
Attackers manipulated temperature and defrost thresholds remotely, a technique matching prior incidents where hackers compromised Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers to trigger defrost functions and raise temperatures. Belgian firm Sabcobel has said the November supermarket attacks exploited the same vulnerability as the October French incidents, though it remains unconfirmed whether CVE-2025-41450 and CVE-2025-41451, previously disclosed by CISA for Danfoss AK-SM 8xxA controllers, are involved in this specific EFS/Coolworld incident.
Remediação
EFS has strengthened monitoring of refrigeration equipment and temperatures and is working with France's ANSSI and the Ministry of Health. Coolworld says it responded promptly, is working with affected customers, and the vulnerability involved a third-party component outside its direct control.
Linha do tempo
-
Cyberattack on Refrigeration Supplier Disrupts Blood Storage Cooling at France's EFS
ler a análise desta fonte ocultar
France's national blood service, Établissement français du sang (EFS), confirmed that a cyberattack on its refrigeration equipment supplier Coolworld Rentals raised temperature and defrost settings at three EFS facilities on November 2, 2026, threatening stored blood products. EFS itself was not directly targeted; attackers exploited a vulnerability in a third-party component used by Coolworld's remote monitoring software. EFS detected the anomaly quickly via its monitoring and alarm systems, allowing staff to repair affected equipment or transfer blood products and plasma to other facilities, with no reported health impact or loss of blood products. The incident is part of a broader wave of attacks on European refrigeration systems, following October and November campaigns that disrupted hundreds of supermarkets across France, Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.
Technical Details
Attackers manipulated temperature and defrost thresholds remotely, a technique matching prior incidents where hackers compromised Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers to trigger defrost functions and raise temperatures. Belgian firm Sabcobel has said the November supermarket attacks exploited the same vulnerability as the October French incidents, though it remains unconfirmed whether CVE-2025-41450 and CVE-2025-41451, previously disclosed by CISA for Danfoss AK-SM 8xxA controllers, are involved in this specific EFS/Coolworld incident.
Remediation
EFS has strengthened monitoring of refrigeration equipment and temperatures and is working with France's ANSSI and the Ministry of Health. Coolworld says it responded promptly, is working with affected customers, and the vulnerability involved a third-party component outside its direct control.