Cyberattack on Coolworld Reprograms EFS Blood Service Freezers Amid Europe-Wide Cold-Chain Sabotage Wave
Hackers compromised refrigeration equipment operated by Coolworld, a cooling contractor for France's national blood service Établissement Français du Sang (EFS), altering freezer setpoints from approximately -30°C to 110°C overnight between November 1 and 2, 2026. The intrusion hit cold-storage sites in the Bourgogne-Franche-Comté region and was first reported by Le Canard enchaîné after an on-call technician noticed abnormal temperature readings. France's Health Ministry said staff intervened in time and that the incident caused no significant operational disruption. EFS initially described the affected materials as donor samples used for transfusion monitoring, but later confirmed that frozen plasma intended for patient transfusions was also involved. EFS subsequently confirmed publicly that its own systems were not directly targeted — only the refrigeration supplier's — and said monitoring and alarm systems enabled rapid detection, with affected equipment either brought under control, neutralized, or its contents preventively transferred to other facilities; it also notified ANSSI and the Ministry of Health (theregister.com). In its own November 3 statement, EFS said the incident raised temperature and defrost thresholds to extremely high levels in affected cold-storage chambers used to store blood products before distribution to hospitals and biological samples, and confirmed that plasma bags intended for transfusions and plasma used to manufacture medicines were either transferred or secured, with blood collection and distribution continuing without interruption (bleepingcomputer.com). Coolworld itself confirmed the incident on November 4, 2026, stating it was "aware of the cybersecurity incident involving remote monitoring software used in refrigeration systems" and that it had "responded promptly by implementing the appropriate measures," without detailing them; it said only a limited number of its units, which it rents out across France, Germany, Ireland, the Netherlands and the UK, were affected (infosecurity-magazine.com). EFS separately confirmed it operates three blood banks whose cold rooms detected and reversed the temperature anomaly before any products were altered; these cold-storage facilities supply blood and plasma to approximately 1,900 healthcare facilities across France (helpnetsecurity.com).
Entenda a falha
A vulnerabilidade
No CVE is listed and the exact flaw is not identified. Coolworld, the refrigeration supplier of France's EFS, says the vulnerability reported in the media is in a third-party component of its remote monitoring software, and it has not named the component or the access method. ANSSI links the wider campaign to Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, thousands of which are reachable from the internet. It is unclear whether the EFS sites used these products. The Belgian firm Sabcobel says the November attacks used the same vulnerability as the October supermarket attacks. CVE-2025-41450 and CVE-2025-41451 (Danfoss AK-SM 8xxA, authentication bypass and remote command execution) are context only, and BleepingComputer says it is not confirmed they are exploited. Affected and fixed versions are not given. The attacker needed network reach to the monitoring layer or controller and could change temperature and defrost setpoints.
Como funciona
The cold rooms are run by controllers managed through the supplier's remote monitoring software, which holds temperature setpoints and defrost thresholds. Someone with access to that remote layer can send new values. Here, the setpoints and defrost thresholds at three EFS sites were set to very high values, reportedly 110°C instead of about -30°C. The system treats them as legitimate configuration and tries to apply them. Reports stress that a setpoint is not the temperature actually reached. An on-call technician and the alarm systems noticed the anomaly overnight, and staff regained control or took equipment out of service. The Health Ministry said remote access to the affected fridges was disabled.
Por que é vulnerável
The articles do not state a root cause for the EFS intrusion. Coolworld blames a flaw in a third-party component it does not control. The wider campaign points to exposure: controllers reachable directly from the internet, and Lupovis saw attempts with publicly documented factory-default credentials against Danfoss AK-SM devices. Remote maintenance access held by a supplier also lets one compromise reach several client environments. The articles do not explain what any fix changes. ANSSI's guidance is to take these controllers off the open internet.
Como foi descoberta
An EFS on-call technician and its monitoring and alarm systems detected the anomaly overnight. Le Canard enchaîné reported the attack on November 3 and named Coolworld, and EFS published a statement the same day without naming the supplier. Coolworld confirmed the incident on November 4 and blamed a third-party component. ANSSI and the Ministry of Health are investigating, and the access vector is unconfirmed. Separately, Lupovis (Xavier Bellekens) saw authentication attempts against Danfoss AK-SM sensors from October 20 to 30, which it reads as preparation for a synchronized attack. Claroty published critical Danfoss controller flaws in August, but no article ties them to this incident.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 19:50.
Detalhes técnicos
The reported 110°C value is a controller setpoint — an instruction given to the refrigeration system — rather than a confirmed internal temperature of the storage compartments or the plasma bags themselves; neither actual product temperatures nor exposure duration has been disclosed. Investigators have not publicly identified the initial access method, any exploited vulnerability, the controller models involved, or the attackers responsible, and remote manipulation of refrigeration parameters remains consistent with the reported behavior without confirming a specific exploit. No confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft have been reported. Whether the EFS intrusion used the same access route as the separate supermarket-focused attack wave remains unclear (theregister.com). Coolworld stated that the vulnerability "currently being reported in the media concerns a component supplied by a third-party provider and not directly controlled by Coolworld," pointing to a supply-chain dependency within its remote monitoring software rather than a flaw in its own systems; it did not identify the third-party component (infosecurity-magazine.com). EFS president Frédéric Pacoud told French broadcaster BFMTV that the service "could have lost samples or bags of plasma intended to treat patients" had the early warning not occurred, but that the timely detection meant there was no compromise to the safety of blood products (infosecurity-magazine.com).
The incident follows a wave of attacks on French supermarket refrigeration systems that abused automatic defrost functions to cause prolonged heating, and a broader European refrigeration sabotage campaign. Initially affecting Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands, the campaign has since been confirmed to have also hit stores in Finland, Germany, Portugal, and Romania (theregister.com). The UK's NCSC chief executive Richard Horne said he was aware of a couple of impacts in the UK's own food supply chain, and the British Association of Independent Meat Suppliers (AIMS) reported that some of its 300-plus members had become collateral victims, with two reporting their fridges had begun defrosting (theregister.com). This supermarket wave, which hit French chains Carrefour, Coopérative U, Intermarché, and Monoprix among others, began about a month before the EFS disclosure; a related incident affecting US military commissaries that also caused food wastage occurred in August (theregister.com). The October French supermarket attacks, estimated to have hit 250 to 350 stores including Intermarché, Carrefour Market, Monoprix, Leclerc, and Super U, reportedly compromised refrigeration controllers running older Danfoss software and remotely activated automatic defrosting functions, targeting Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers (bleepingcomputer.com). A second wave this month affected more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia, with some systems shut down entirely and others having temperatures changed remotely; one Swedish supermarket's system reportedly began generating heat while another store's temperature was changed to 50°C (122°F) (bleepingcomputer.com). Belgian refrigeration company Sabcobel said the attackers behind the November incidents exploited the same vulnerability used in October's attacks against French supermarkets (bleepingcomputer.com). ANSSI and CERT-FR issued warnings about Danfoss AK-SM/AK-SC controllers and Copeland and Dixell XWEB systems; however, no evidence confirms these specific product families were deployed at the affected EFS facilities, and the technical link between the supermarket wave and the Coolworld intrusion remains unproven. In 2025, CISA disclosed two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451, which could allow attackers to bypass authentication and execute commands remotely, potentially giving them control over refrigeration equipment, though it has not been confirmed whether these vulnerabilities are being exploited in the current attacks (bleepingcomputer.com). Researcher Xavier Bellekens, CEO of threat intelligence firm Lupovis, told Help Net Security that starting October 20, 2026, his company observed authentication attempts against Danfoss AK-SM refrigeration controller sensors originating from ASNs previously categorized as bullet-proof hosting and used by Russian adversaries; most attempts used publicly documented factory-default credentials, with probing continuing until October 30 in an apparent effort to compromise as many devices as possible ahead of a widespread, synchronized attack (helpnetsecurity.com).
Remediação
The incident highlights risk arising from refrigeration contractors' maintenance connectivity, which can expose medical cold-chain systems even without a direct breach of the healthcare organization's primary network. Recommended priorities include limiting exposed management interfaces and administrative connections on OT/refrigeration controllers, maintaining independent temperature monitoring separate from vendor-managed systems, patching known Danfoss AK-SM/AK-SC vulnerabilities (including CVE-2025-41450 and CVE-2025-41451) per CERT-FR guidance, and ensuring alarm and escalation procedures can detect dangerous deviations before stored medical products become unusable. Independent verification of actual product conditions is essential whenever a suspected cold-chain interruption follows a controller compromise. Coolworld's confirmation that the flaw lies in a third-party component within its remote monitoring software further underscores the need for vendors to audit and patch supply-chain dependencies in OT monitoring platforms before they are exploited across multiple client sites. Given reports of credential-based probing against Danfoss AK-SM controllers from bullet-proof hosting infrastructure, operators should audit internet-exposed controllers for default or weak credentials and restrict remote administrative access. EFS said its technical teams are working with ANSSI and the Ministry of Health and has strengthened monitoring of refrigeration equipment and temperatures (bleepingcomputer.com).
Linha do tempo
-
Hackers Altered Refrigeration Setpoints at Three French Blood Service Sites via Coolworld Supplier
The article adds expert commentary not previously captured in the case report: Darin Fredde of Ridge Security distinguished between an attempted setpoint manipulation and a confirmed physical temperature change, crediting EFS's monitoring, alarms, and staff response for preventing damage, while Damon Small of Xcape, Inc. argued that internet-connected devices capable of affecting human safety require strong authentication and access controls equivalent to other critical operational technology. It also clarifies that EFS confirmed operating thresholds were altered but did not itself publish the widely reported 110°C figure, framing it as a programmed setpoint rather than an actual temperature reached by the plasma.
ler a análise desta fonte ocultar
The article adds expert commentary not previously captured in the case report: Darin Fredde of Ridge Security distinguished between an attempted setpoint manipulation and a confirmed physical temperature change, crediting EFS's monitoring, alarms, and staff response for preventing damage, while Damon Small of Xcape, Inc. argued that internet-connected devices capable of affecting human safety require strong authentication and access controls equivalent to other critical operational technology. It also clarifies that EFS confirmed operating thresholds were altered but did not itself publish the widely reported 110°C figure, framing it as a programmed setpoint rather than an actual temperature reached by the plasma.
Hackers tampered with refrigeration controls at three sites operated by France's Établissement français du sang (EFS) on November 2, 2026, altering equipment managed through a third-party refrigeration supplier. EFS said temperature and defrost thresholds were changed to extremely high settings, but its monitoring and alarm systems detected the anomaly and staff intervened before stored plasma and biological samples were damaged, with no interruption to blood collection or distribution. French outlet Le Canard enchaîné reported the equipment, normally kept near -30°C, had settings changed to 110°C, though EFS did not confirm that specific figure and clarified it described a programmed setpoint rather than a temperature the plasma actually reached. The supplier, later named by media as Coolworld, acknowledged an incident in its remote-monitoring software and attributed the vulnerability to a third-party component outside its direct control. The incident follows a wider wave of attacks on refrigeration systems at European supermarkets and UK food suppliers, though investigators have not established a link between the EFS case and the earlier retail incidents.
Technical Details
An on-duty technician reportedly noticed the abnormal readings overnight between November 1 and 2; depending on the installation, staff either brought equipment back under control or took it out of service and moved products to other cold-storage facilities. Security experts quoted in the article stressed the distinction between an attempted manipulation and a confirmed physical consequence: Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, noted that changing a temperature setpoint is not the same as changing the actual physical temperature, and that EFS's monitoring, alarms, and staff response appear to have prevented damage. Coolworld's November 4 statement said a limited number of its units were affected but did not identify the third-party component or explain how the attackers gained access. EFS's technical teams are working with ANSSI and the Health Ministry, and investigators are still examining the initial access method, the scope of affected equipment, and the conditions required to safely restore the installations.
Remediation
Damon Small, a board member at Xcape, Inc., said any internet-connected device capable of affecting human safety must have strong authentication and access controls, with access restricted to authorized users, and argued that such operational technology deserves the same level of protection as other critical systems. EFS has strengthened equipment and temperature monitoring across its facilities following the incident.
-
French authorities probe cyberattack targeting nation’s blood supply
ler a análise desta fonte ocultar
Authorities are investigating a cyberattack targeting a refrigeration-equipment supplier for the French Blood Establishment (EFS), which oversees France’s civilian blood supply.
An unknown hacker was able to manipulate temperature controls at cold storage rooms for three EFS sites, according to the agency. Temperatures and defrosting thresholds were raised to very high levels.
-
French Blood Bank EFS Thwarts Fridge-Tampering Cyberattack as Ahold Delhaize Discloses €250M Sales Hit
This article confirms the EFS/Coolworld blood bank refrigeration incident occurred on Monday, November 2, 2026, with EFS's own statement and Coolworld's response, and adds that Ahold Delhaize, a victim of the earlier mid-October supermarket refrigeration attack wave, has now disclosed in its quarterly earnings that the cyberattack is expected to cut its Q4 sales by up to €250 million ($281 million) and operating income by up to €100 million, with CEO Franz Muller stating that disruption was largely contained within two weeks but full restoration of normal operations continues.
ler a análise desta fonte ocultar
This article confirms the EFS/Coolworld blood bank refrigeration incident occurred on Monday, November 2, 2026, with EFS's own statement and Coolworld's response, and adds that Ahold Delhaize, a victim of the earlier mid-October supermarket refrigeration attack wave, has now disclosed in its quarterly earnings that the cyberattack is expected to cut its Q4 sales by up to €250 million ($281 million) and operating income by up to €100 million, with CEO Franz Muller stating that disruption was largely contained within two weeks but full restoration of normal operations continues.
A cyberattack against Coolworld, a refrigeration equipment supplier serving three cold-storage sites of France's Établissement Français du Sang (EFS), attempted to raise temperature and defrosting thresholds to extremely high levels but was detected before any blood products or samples were compromised. The French Blood Establishment, or EFS, said “temperature and defrosting thresholds were raised to extremely high levels” on Monday at three of its cold-storage sites for plasma, in a statement released late Tuesday. French weekly newspaper Le Canard Enchaîné, which first reported the cyberattack, said that the attack had attempted to reset temperatures that normally are at minus 30 Celsius (minus 22 Fahrenheit) to as high as 110 C (230 F). The incident follows a mid-October wave of similar refrigeration attacks against supermarkets and stores across France, Belgium and the Netherlands, and one of the chains hit then, Ahold Delhaize, has now disclosed the financial toll of that earlier campaign.
Technical Details
Monitoring systems quickly detected the problem, allowing staff to take action in time so that no blood products or samples were compromised. The cyberattack hit a supplier of refrigeration equipment at three EFS sites; the products stored, bags of plasma intended for transfusions and plasma used to manufacture medicines, were either transferred or secured. “No health consequences have been identified, and no blood products were lost,” the blood bank said. The EFS said blood collection and distribution operations remain uninterrupted, ensuring continued services for patients at hospitals and other healthcare. Coolworld said in a statement it “is aware” of the cybersecurity incident, and that “the vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld’s direct control,” adding that only a limited number of units were affected and it was taking “appropriate measures.” France’s national cybersecurity agency and the Health Ministry are investigating the incident.
On the broader campaign, this week’s cyberattacks on refrigeration systems mirrored an episode in mid-October that targeted fridges and freezers at hundreds of supermarkets and independent stores across France, Belgium and the Netherlands. Ahold Delhaize said it expected the cyberattack to reduce its sales in the fourth quarter by as much as 250 million euros ($281 million), and crimp its operating income for the period by up to 100 million euros. CEO Franz Muller said “while most of the disruption was contained within two weeks, work continues to fully restore our normal operations,” adding that “cyber threats are an increasingly harsh reality of doing business today.” The company had earlier blamed “malicious actions by others” and proactively took some of its systems offline, including websites and apps for its various brands in Europe as well as in the United States.
Remediation
EFS's rapid internal monitoring and alarm systems allowed staff to secure or relocate plasma before any product loss, underscoring the value of detection independent of vendor telemetry in third-party-managed cold-chain infrastructure. The EFS incident, combined with Ahold Delhaize's multi-hundred-million-euro disclosed impact, illustrates the material operational and financial risk that OT/refrigeration compromises pose across both healthcare and retail sectors.
-
Cyberattack on Coolworld Refrigeration Systems Threatens French Blood Plasma Storage Amid EU Infrastructure Warnings
This article adds official warnings framing the Coolworld/EFS incident within a broader pattern of risk to critical infrastructure: ANSSI director-general Vincent Strubel's October 2026 warning that refrigeration facilities, including those storing medical supplies, could be targeted, and UK NCSC chief executive Richard Horne's remarks at the launch of the *State of the Cyber Nation* report, which named electricity distribution, water facility floodgates and dam operations, industrial production lines, and refrigeration controls as exploitable systems, and compared UK cyber vulnerabilities to a "digital Leaning Tower of Pisa" while warning of a possible unprecedented rise in cyber incidents.
ler a análise desta fonte ocultar
This article adds official warnings framing the Coolworld/EFS incident within a broader pattern of risk to critical infrastructure: ANSSI director-general Vincent Strubel's October 2026 warning that refrigeration facilities, including those storing medical supplies, could be targeted, and UK NCSC chief executive Richard Horne's remarks at the launch of the State of the Cyber Nation report, which named electricity distribution, water facility floodgates and dam operations, industrial production lines, and refrigeration controls as exploitable systems, and compared UK cyber vulnerabilities to a "digital Leaning Tower of Pisa" while warning of a possible unprecedented rise in cyber incidents.
Between November 1 and 2, 2026, attackers compromised refrigeration systems supplied by Coolworld, a vendor serving France's Établissement Français du Sang (EFS), reprogramming freezer setpoints from -30°C to 110°C, according to the site Cyberattaque cited by Cyber Security News. It remains unclear whether the units actually reached that temperature. The attackers did not directly breach EFS's medical facilities but instead compromised the third-party maintenance systems that control freezer temperatures, a foothold that could expose multiple refrigeration systems across different clients served by the same maintenance provider. France's Health Ministry said the incident caused no significant operational consequences, as the temperature anomalies were quickly detected and corrected, though the number of facilities affected, the duration of the disruption, and the actual temperatures reached have not been disclosed, nor has any confirmed loss of blood stock.
Technical Details
The incident follows a similar wave of attacks on supermarket refrigeration systems in Europe weeks earlier. It also comes roughly two weeks after Vincent Strubel, director-general of France's ANSSI, warned in October 2026 that refrigeration facilities, including those storing medical supplies, could become targets of cyberattacks. In the UK, Richard Horne, chief executive of the National Cyber Security Centre (NCSC), separately flagged the fragility of technological and operational structures across organizations and supply chains. During the launch of the State of the Cyber Nation report, Horne listed several categories of systems exposed to cyberattacks, including electricity distribution, water facility floodgates and dam operations, industrial production lines, and refrigeration controls. He described the current moment as a crossroads for UK cybersecurity, comparing existing vulnerabilities to a "digital Leaning Tower of Pisa," and warned that the UK could face an unprecedented rise in cyber incidents in the coming months.
Remediation
The case reinforces the risk posed by third-party maintenance connectivity to critical physical infrastructure, where a single compromised vendor can expose refrigeration systems across multiple customers, including those supporting essential healthcare services.
-
Cyberattack Hits French Blood Banks as Hackers Target Refrigeration Systems Across Europe
ler a análise desta fonte ocultar
Cyberattack Hits French Blood Banks as Hackers Target Refrigeration Systems Across Europe
Cyberattacks disrupted refrigeration monitoring systems at three French blood banks, amid similar attacks targeting European supermarkets.
-
EFS Confirms Coolworld Refrigeration Hack Raised Blood Storage Temperatures in France
This article adds EFS's own confirmation statement (November 3) detailing that the November 2 incident raised temperature and defrost thresholds, and that plasma intended for transfusions and medicine manufacturing was transferred or secured without loss. It also adds a statement from Belgian refrigeration company Sabcobel that the November European supermarket attacks exploited the same vulnerability as October's French supermarket wave, specific examples of affected Swedish stores (heat generation, 50°C readings), and detail on CISA's 2025 disclosure of CVE-2025-41450 and CVE-2025-41451 affecting Danfoss AK-SM 8xxA controllers, while noting it remains unconfirmed whether these flaws are being exploited in the current attacks.
ler a análise desta fonte ocultar
This article adds EFS's own confirmation statement (November 3) detailing that the November 2 incident raised temperature and defrost thresholds, and that plasma intended for transfusions and medicine manufacturing was transferred or secured without loss. It also adds a statement from Belgian refrigeration company Sabcobel that the November European supermarket attacks exploited the same vulnerability as October's French supermarket wave, specific examples of affected Swedish stores (heat generation, 50°C readings), and detail on CISA's 2025 disclosure of CVE-2025-41450 and CVE-2025-41451 affecting Danfoss AK-SM 8xxA controllers, while noting it remains unconfirmed whether these flaws are being exploited in the current attacks.
France's national blood service Établissement Français du Sang (EFS) confirmed that a cyberattack on its refrigeration supplier Coolworld Rentals raised temperature and defrost thresholds at three of its cold-storage facilities on November 2, 2026, threatening stored blood products. EFS said it was not directly targeted; the attackers compromised Coolworld's remote monitoring software by exploiting a vulnerability in a third-party component outside the vendor's control. EFS's monitoring and alarm systems detected the anomaly quickly, allowing staff to repair equipment or transfer plasma bags intended for transfusions and medicine manufacturing to other facilities, with no health impact or loss of blood products reported. The incident is part of a wider European wave of refrigeration sabotage that previously disrupted 250 to 350 French supermarkets in October and more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia this month.
Technical Details
Belgian refrigeration company Sabcobel stated that the attackers behind the November incidents exploited the same vulnerability used in October's attacks against French supermarkets. The earlier supermarket attacks reportedly compromised refrigeration controllers running older Danfoss software and remotely activated automatic defrosting functions, raising temperatures and forcing stores to discard fresh and frozen products, targeting Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers. In the second wave, some refrigeration systems were shut down entirely, while others had their temperature settings changed remotely; at one Swedish supermarket the system reportedly began generating heat, while another store reported temperatures changed to 50°C (122°F). Separately, CISA disclosed in 2025 two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451, which could allow attackers to bypass authentication and execute commands remotely on vulnerable systems, potentially giving them control over refrigeration equipment, though it has not been confirmed whether these vulnerabilities are being exploited in the attacks.
Remediation
EFS said its technical teams are working with France's national cybersecurity agency ANSSI and the Ministry of Health, and has strengthened monitoring of refrigeration equipment and temperatures. Organizations relying on third-party refrigeration or cold-chain monitoring vendors should maintain independent temperature verification, restrict remote administrative access to controllers, and patch known Danfoss AK-SM/AK-SC vulnerabilities to reduce exposure to this ongoing campaign.
-
French Blood Banks Detect and Reverse Cold-Room Sabotage Tied to Refrigeration Provider Hack
This report adds that three EFS blood banks specifically detected and reversed the cold-room temperature anomaly, that the affected cold rooms serve approximately 1,900 healthcare facilities across France, and that the compromise of the unnamed refrigeration provider occurred on November 2, 2026, coinciding with the wider European supermarket refrigeration attack wave. It also introduces new technical intelligence from researcher Xavier Bellekens of Lupovis: starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors from ASNs linked to bullet-proof hosting and Russian adversaries, most using publicly documented factory-default credentials, with probing continuing until October 30 in an apparent preparation for a synchronized attack.
ler a análise desta fonte ocultar
This report adds that three EFS blood banks specifically detected and reversed the cold-room temperature anomaly, that the affected cold rooms serve approximately 1,900 healthcare facilities across France, and that the compromise of the unnamed refrigeration provider occurred on November 2, 2026, coinciding with the wider European supermarket refrigeration attack wave. It also introduces new technical intelligence from researcher Xavier Bellekens of Lupovis: starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors from ASNs linked to bullet-proof hosting and Russian adversaries, most using publicly documented factory-default credentials, with probing continuing until October 30 in an apparent preparation for a synchronized attack.
Three French blood banks under the Établissement Français du Sang (EFS) detected and reversed a potentially destructive temperature spike in their cold rooms after a cyberattack hit a refrigeration equipment provider used by EFS, the only civilian blood collection and transfusion organization in France. EFS said it was not directly targeted, but anomalies changed operating parameters on cold rooms running the provider's solution, setting temperature and defrost thresholds to very high levels. EFS's monitoring and alarm systems caught the anomalies in time, no blood samples or products were altered, and affected products were moved to other facilities while collection and distribution continued unaffected. These cold rooms store blood and plasma before distribution to roughly 1,900 healthcare facilities across France, and EFS is working with ANSSI and the Ministry of Health while stepping up monitoring.
Technical Details
EFS said the still-unnamed equipment provider was compromised on November 2, 2026, coinciding with a broader wave of cyberattacks on refrigeration units at European supermarkets, with initial reports of affected stores in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, the Netherlands, Portugal and Romania. Attribution for this wider campaign remains unknown. Xavier Bellekens, CEO of Lupovis, told Help Net Security that starting October 20 his company observed authentication attempts targeting Danfoss AK-SM refrigeration controller sensors, originating from ASNs previously categorized as bullet-proof hosting and used by Russian adversaries. Most of these attempts used publicly documented factory-default credentials, and the probing continued until October 30, suggesting an effort to compromise as many devices as possible ahead of a synchronized attack.
Remediation
Organizations relying on third-party refrigeration or cold-chain monitoring providers should ensure independent temperature monitoring and alarm thresholds that are not solely dependent on vendor-managed systems, and should audit internet-facing refrigeration controllers such as Danfoss AK-SM for default or weak credentials, restricting remote management access where possible.
-
Coolworld Confirms Cyberattack on Refrigeration Systems After French Blood Service Cold Rooms Hit 110°C
Coolworld itself publicly confirmed the cyberattack on November 4, 2026, stating it involved remote monitoring software and affected only a limited number of its units, and attributing the underlying vulnerability to a third-party component outside its direct control. EFS president Frédéric Pacoud also gave a direct statement on the potential impact and the successful early detection, adding confirmation that no blood products were compromised and that EFS's own IT systems were not affected.
ler a análise desta fonte ocultar
Coolworld itself publicly confirmed the cyberattack on November 4, 2026, stating it involved remote monitoring software and affected only a limited number of its units, and attributing the underlying vulnerability to a third-party component outside its direct control. EFS president Frédéric Pacoud also gave a direct statement on the potential impact and the successful early detection, adding confirmation that no blood products were compromised and that EFS's own IT systems were not affected.
Dutch refrigeration contractor Coolworld confirmed a cyberattack on November 4, 2026, after French newspaper Le Canard enchaîné reported that unauthorized actors took control of refrigeration controllers in cold-storage rooms operated by France's national blood service Établissement Français du Sang (EFS), pushing temperatures from a normal -30°C to as high as 110°C overnight between November 1 and 2. The affected facilities are located in the Burgundy and Franche-Comté region and store blood samples and plasma intended for transfusions. An on-call EFS technician noticed the abnormal temperature rise overnight, allowing the issue to be caught before it caused any operational impact. The French Ministry of Health and EFS president Frédéric Pacoud both stressed that no blood products were compromised thanks to early detection.
Technical Details
Coolworld, which rents temperature-control equipment in France, Germany, Ireland, the Netherlands and the UK, said it was "aware of the cybersecurity incident involving remote monitoring software used in refrigeration systems" and that it "responded promptly by implementing the appropriate measures," though it did not disclose what those measures were. The company stated that only a limited number of its units were affected and said the reported vulnerability "concerns a component supplied by a third-party provider and not directly controlled by Coolworld." EFS president Frédéric Pacoud told BFMTV the service "could have lost samples or bags of plasma intended to treat patients" had the early warning not occurred, adding there was no compromise to the safety of blood products. At the time of reporting, nothing indicated that EFS's own IT systems were affected by the attack, and EFS had not responded to a request for comment.
Remediation
The incident underscores the exposure created by third-party refrigeration and remote-monitoring vendors with access into healthcare cold-chain infrastructure, even when the healthcare organization's own network is untouched. Independent temperature monitoring and rapid alarm escalation, as demonstrated by the EFS on-call technician's detection, remain critical compensating controls while the specific vulnerable component supplied to Coolworld is identified and remediated.
-
EFS Blood Service Confirms Refrigeration Supplier Hack as Cold-Chain Attacks Spread Across Europe and UK
The Register's report confirms EFS's own statement that its systems were not directly breached, only the refrigeration supplier's, and details the broader context: the attack wave has now spread to Estonia, Finland, Germany, Portugal, Romania, and the Netherlands beyond the initial Belgium, Ireland, Luxembourg, and Sweden; the UK's NCSC chief acknowledged a couple of impacts on the UK food supply chain, with the meat suppliers association AIMS reporting member fridges defrosting; and the article places the EFS incident a month after an earlier supermarket-focused wave hitting Carrefour, Coopérative U, Intermarché, and Monoprix, as well as a prior August incident at US military commissaries.
ler a análise desta fonte ocultar
The Register's report confirms EFS's own statement that its systems were not directly breached, only the refrigeration supplier's, and details the broader context: the attack wave has now spread to Estonia, Finland, Germany, Portugal, Romania, and the Netherlands beyond the initial Belgium, Ireland, Luxembourg, and Sweden; the UK's NCSC chief acknowledged a couple of impacts on the UK food supply chain, with the meat suppliers association AIMS reporting member fridges defrosting; and the article places the EFS incident a month after an earlier supermarket-focused wave hitting Carrefour, Coopérative U, Intermarché, and Monoprix, as well as a prior August incident at US military commissaries.
France's Établissement Français du Sang (EFS), the national civilian blood service, confirmed that attackers compromised a refrigeration supplier used to control cold-storage equipment holding blood samples and frozen plasma intended for transfusion. EFS said its own systems were not directly targeted and that monitoring and alarm systems allowed rapid detection, so no blood products or samples were compromised; affected units were brought under control, neutralized, or had their contents preventively moved to other facilities. According to reports cited in the article, attackers changed cold-room temperature settings from -30°C to 110°C, though this does not confirm the equipment or its contents actually reached that temperature. EFS notified ANSSI, France's cybersecurity agency, and the Ministry of Health. The incident is part of a wider wave of attacks on refrigeration systems that, a day earlier, hit supermarket chains across Europe by remotely triggering defrost cycles, spoiling food stock.
Technical Details
Stores across Belgium, Ireland, Luxembourg, and Sweden were the first to report issues, although cases from Estonia, Finland, Germany, Portugal, Romania, and the Netherlands have since been confirmed. Richard Horne, chief executive of the UK's National Cyber Security Centre (NCSC), said he was aware of "a couple of impacts" in the UK's own food supply chain, and the British Association of Independent Meat Suppliers (AIMS) told the BBC that some of its more than 300 members had become "collateral" in the attacks, with two reporting that their fridges had begun defrosting. The latest wave of cold-store attacks comes a month after the first, which affected French supermarket chains Carrefour, Coopérative U, Intermarché, Monoprix, and others. Some affected chains identified Danfoss controllers in their systems; others said they did not use the company's equipment, and CERT-FR published an advisory at the time urging organizations to remediate vulnerabilities in Danfoss AK-SM and AK-SC controllers. Whether the EFS intrusion used the same access route as the supermarket campaign remains unclear, and the attackers behind the refrigeration attacks have not been identified. The attacks in France followed reports of compromises at US military commissaries, which also led to food wastage in August.
Remediation
The case underscores the risk of third-party refrigeration and cold-chain contractors as an attack path into healthcare and food-supply operations, even without a direct breach of the victim's own network. Organizations relying on externally managed refrigeration controllers should enforce independent temperature monitoring, segment vendor remote-access connections, patch known Danfoss AK-SM/AK-SC vulnerabilities per CERT-FR guidance, and ensure alarm escalation can catch anomalous setpoint changes before stored products are compromised.
-
Cyberattack on Coolworld Reprograms EFS Blood Service Freezers From -30°C to 110°C
ler a análise desta fonte ocultar
Hackers compromised refrigeration equipment operated by Coolworld, a cooling contractor for France's national blood service Établissement Français du Sang (EFS), altering freezer setpoints from approximately -30°C to 110°C overnight between November 1 and 2, 2026. The intrusion hit cold-storage sites in the Bourgogne-Franche-Comté region and was first reported by Le Canard enchaîné after an on-call technician noticed abnormal temperature readings. France's Health Ministry said staff intervened in time and that the incident caused no significant operational disruption. EFS initially described the affected materials as donor samples used for transfusion monitoring, but later confirmed that frozen plasma intended for patient transfusions was also involved.
Technical Details
The reported 110°C value is a controller setpoint — an instruction given to the refrigeration system — rather than a confirmed internal temperature of the storage compartments or the plasma bags themselves; neither actual product temperatures nor exposure duration has been disclosed. Investigators have not publicly identified the initial access method, any exploited vulnerability, the controller models involved, or the attackers responsible, and remote manipulation of refrigeration parameters remains consistent with the reported behavior without confirming a specific exploit. No confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft have been reported. The incident follows a wave of attacks on French supermarket refrigeration systems that abused automatic defrost functions to cause prolonged heating, and a broader European refrigeration sabotage campaign affecting Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands, for which ANSSI issued warnings about Danfoss AK-SM/AK-SC controllers and Copeland and Dixell XWEB systems; however, no evidence confirms these specific product families were deployed at the affected EFS facilities, and the technical link between the supermarket wave and the Coolworld intrusion remains unproven.
Remediation
The incident highlights risk arising from refrigeration contractors' maintenance connectivity, which can expose medical cold-chain systems even without a direct breach of the healthcare organization's primary network. Recommended priorities include limiting exposed management interfaces and administrative connections on OT/refrigeration controllers, maintaining independent temperature monitoring separate from vendor-managed systems, and ensuring alarm and escalation procedures can detect dangerous deviations before stored medical products become unusable. Independent verification of actual product conditions is essential whenever a suspected cold-chain interruption follows a controller compromise.