Attackers Manipulate Refrigeration Controls at French Blood Service Supplier Coolworld, Setting Freezers to 110°C
Between November 1–2, 2026, hackers reportedly compromised refrigeration equipment operated by Coolworld, a contractor serving France's Établissement Français du Sang (EFS), altering freezer setpoints from roughly -30°C to 110°C. The attack affected facilities in Bourgogne-Franche-Comté and was first reported by Le Canard enchaîné on November 3 after an on-call technician noticed abnormal temperature readings. France's Health Ministry said technicians intervened in time to prevent major operational disruption. EFS initially said only donor samples used for transfusion monitoring were affected, later clarifying that frozen plasma intended for patient transfusions was also involved.
Detalhes técnicos
The incident centers on a malicious setpoint change—a controller instruction for desired temperature—rather than confirmed proof that storage compartments or plasma bags actually reached 110°C; neither real product temperatures nor exposure duration have been disclosed. Investigators have not publicly identified the initial access vector, exploited vulnerability, controller models, or threat actor. The attack resembles earlier incidents against French supermarket refrigeration systems where intruders abused automatic defrost functions to cause prolonged heating, though a technical link to the Coolworld intrusion is unproven. A broader European refrigeration sabotage report cited similar incidents in Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands, referencing ANSSI warnings about Danfoss AK-SM, AK-SC, Copeland, and Dixell XWEB controllers, though no evidence confirms these products were used at the affected EFS facilities. No confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft has been reported.
Remediação
Healthcare operators and refrigeration contractors should limit exposed interfaces on OT/building control systems, restrict and monitor remote maintenance connectivity, enforce independent temperature monitoring separate from vendor-controlled systems, and ensure alarm and escalation procedures detect dangerous deviations before stored medical products are compromised. Verification of actual product conditions, rather than reliance on controller setpoints alone, is essential when assessing suspected cold-chain interruptions.
Linha do tempo
-
Attackers Manipulate Refrigeration Controls at French Blood Service Supplier Coolworld, Setting Freezers to 110°C
ler a análise desta fonte ocultar
Between November 1–2, 2026, hackers reportedly compromised refrigeration equipment operated by Coolworld, a contractor serving France's Établissement Français du Sang (EFS), altering freezer setpoints from roughly -30°C to 110°C. The attack affected facilities in Bourgogne-Franche-Comté and was first reported by Le Canard enchaîné on November 3 after an on-call technician noticed abnormal temperature readings. France's Health Ministry said technicians intervened in time to prevent major operational disruption. EFS initially said only donor samples used for transfusion monitoring were affected, later clarifying that frozen plasma intended for patient transfusions was also involved.
Technical Details
The incident centers on a malicious setpoint change—a controller instruction for desired temperature—rather than confirmed proof that storage compartments or plasma bags actually reached 110°C; neither real product temperatures nor exposure duration have been disclosed. Investigators have not publicly identified the initial access vector, exploited vulnerability, controller models, or threat actor. The attack resembles earlier incidents against French supermarket refrigeration systems where intruders abused automatic defrost functions to cause prolonged heating, though a technical link to the Coolworld intrusion is unproven. A broader European refrigeration sabotage report cited similar incidents in Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands, referencing ANSSI warnings about Danfoss AK-SM, AK-SC, Copeland, and Dixell XWEB controllers, though no evidence confirms these products were used at the affected EFS facilities. No confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft has been reported.
Remediation
Healthcare operators and refrigeration contractors should limit exposed interfaces on OT/building control systems, restrict and monitor remote maintenance connectivity, enforce independent temperature monitoring separate from vendor-controlled systems, and ensure alarm and escalation procedures detect dangerous deviations before stored medical products are compromised. Verification of actual product conditions, rather than reliance on controller setpoints alone, is essential when assessing suspected cold-chain interruptions.