Coolworld hack lets attackers push French blood-service (EFS) freezer setpoints from -30°C to 110°C; no plasma lost, tied to Europe-wide fridge attacks

Linha do tempo

1. securityonline.info ↗ · pub. 06/11/2026 04:05 · coletado 06/11 06:00

   French Blood Bank Cyberattack Hits Plasma Storage

   ler a análise desta fonte ocultar

   A critical supply chain intrusion recently threatened France’s medical infrastructure. Specifically, a French blood bank cyberattack struck industrial refrigeration equipment supporting the French Blood Establishment (EFS). Unknown adversaries altered the temperature thresholds across several national plasma cold storage repositories. Fortunately, automated environmental monitoring alarms identified the temperature spike immediately. Consequently, emergency technicians transferred the biological inventory to safe reserves without incurring damage.

   The intrusion occurred between the late evening of November 1 and November 2, 2026. Intruders compromised CoolWorld, a specialized contractor providing cooling solutions to health facilities. Subsequently, the attackers manipulated supervisory control software governing the cold storage chambers. Standard storage protocols mandate maintaining blood plasma at minus thirty degrees Celsius. However, the perpetrators adjusted temperature targets upward to an extreme one hundred ten degrees Celsius.

2. hackread.com ↗ · pub. 05/11/2026 14:06 · coletado 05/11 16:01

   Hackers Tamper With Refrigeration Controls at France's EFS Blood Service via Coolworld

   This article adds expert commentary not previously captured in the case report: Darin Fredde of Ridge Security distinguishes between a controller setpoint change and an actual physical temperature change, crediting the monitoring, alarms and staff response for preventing damage, while Damon Small of Xcape, Inc. stresses that internet-connected devices capable of affecting human safety require strong authentication and access controls, placing refrigeration OT on par with other critical operational technology.

   ler a análise desta fonte ocultar

   This article adds expert commentary not previously captured in the case report: Darin Fredde of Ridge Security distinguishes between a controller setpoint change and an actual physical temperature change, crediting the monitoring, alarms and staff response for preventing damage, while Damon Small of Xcape, Inc. stresses that internet-connected devices capable of affecting human safety require strong authentication and access controls, placing refrigeration OT on par with other critical operational technology.

   Hackers altered refrigeration controls at three sites operated by France's national blood service Établissement français du sang (EFS), prompting staff to secure stored plasma and move supplies before any products were damaged. EFS said the November 2, 2026 incident affected equipment managed through a refrigeration supplier, with no interruption to blood collection or distribution. The affected cold rooms held plasma intended for transfusions and the manufacture of medicines, along with stored biological samples. In its November 3 statement, EFS said temperature and defrost thresholds had been changed to extremely high settings, and that its monitoring and alarm systems detected the changes, allowing staff to intervene before the stored products were affected. The incident follows a wave of attacks on supermarket and food-supplier refrigeration systems in Europe.

   Technical Details

   According to Le Canard enchaîné, whose reporting was also covered by TF1, the attack occurred overnight from November 1 to 2, with settings on equipment normally maintained around minus 30°C reportedly changed to 110°C; EFS confirmed that operating thresholds had been altered but did not publish the 110°C figure itself, and that figure describes a programmed setpoint rather than a temperature the plasma actually reached. An on-duty technician reportedly noticed the problem during the night, and depending on the installation, staff brought equipment under control or took it out of service and transferred products to other cold-storage facilities. EFS said neither the plasma nor its stored samples were damaged, and its technical teams are working with France's national cybersecurity agency ANSSI and the Health Ministry; investigators are examining how the hackers gained access, which equipment was affected, and the conditions required to safely return installations to service. Although EFS did not identify its refrigeration supplier, Le Canard enchaîné named Coolworld, including in connection with facilities in Bourgogne-Franche-Comté. Coolworld subsequently acknowledged a cybersecurity incident involving refrigeration remote-monitoring software, said in its November 4 statement that a limited number of its units had been affected, attributed the vulnerability described in media reports to a third-party component outside its direct control, and said it had taken protective measures and was supporting customers without discussing individual cases or identifying the component involved. The EFS incident follows attacks on refrigeration systems at European supermarkets and UK food suppliers, which involved altered temperature settings, defrost functions and, in some cases, disabled alerts, forcing several retailers to discard food; French supermarkets experienced similar disruption in October, though investigators have not established whether the EFS incident involved the same hackers or access method. Security experts quoted by Hackread.com stressed caution in interpreting the reported figures: Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, noted the distinction between changing a temperature setpoint and changing the physical temperature, and credited the reported monitoring, alarms and staff response for preventing damage. Damon Small, a board member at Xcape, Inc., said any internet-connected device capable of affecting human safety must have strong authentication and access controls, restricted to authorized users through appropriate filtering and security mechanisms.

   Remediation

   Damon Small of Xcape, Inc. argued that operational technology capable of affecting human safety deserves the same level of protection as any other critical OT system, including strong authentication, access restriction and filtering for internet-connected equipment.

3. cybersecuritydive.com ↗ · pub. 05/11/2026 12:52 · coletado 05/11 14:02

   French Authorities Probe Cyberattack Manipulating Refrigeration at Blood Supply Sites via Coolworld Supplier

   This report adds ANSSI's direct confirmation that it has identified compromises specifically involving Danfoss AK-SM/AK-SC and Copeland/Dixell xweb controllers, and that thousands of such devices remain exposed to the internet despite its guidance. It also introduces Claroty's August research disclosing critical remote-code-execution flaws in Danfoss controllers that enable temperature manipulation, and notes that the U.S. Health Information Sharing and Analysis Center (Health-ISAC) issued an advisory to its members about the risk, per CSO Errol Weiss. Additionally, it specifies that U.S. military investigations now cover "outages" at more than half a dozen Army and other commissary bases, broadening the scope of the related U.S. military refrigeration incidents beyond what was previously reported.

   ler a análise desta fonte ocultar

   This report adds ANSSI's direct confirmation that it has identified compromises specifically involving Danfoss AK-SM/AK-SC and Copeland/Dixell xweb controllers, and that thousands of such devices remain exposed to the internet despite its guidance. It also introduces Claroty's August research disclosing critical remote-code-execution flaws in Danfoss controllers that enable temperature manipulation, and notes that the U.S. Health Information Sharing and Analysis Center (Health-ISAC) issued an advisory to its members about the risk, per CSO Errol Weiss. Additionally, it specifies that U.S. military investigations now cover "outages" at more than half a dozen Army and other commissary bases, broadening the scope of the related U.S. military refrigeration incidents beyond what was previously reported.

   French authorities, including ANSSI and the Ministry of Health, are investigating a cyberattack that manipulated temperature controls at cold storage rooms for three sites of the French Blood Establishment (EFS), raising temperatures and defrosting thresholds to very high levels. EFS monitoring systems and alarms detected the activity, allowing staff to regain control and transfer the affected supplies — including blood plasma for transfusions and plasma used in medication fractionation — to other facilities without compromising their integrity. The incident follows a wave of similar attacks in which hackers forced supermarket refrigerators in France and other European countries into superheated defrost cycles, destroying large quantities of food, and is linked to a separate ongoing investigation by the U.S. military into refrigeration "outages" at more than half a dozen Army and other commissary bases.

   Technical Details

   ANSSI told Cybersecurity Dive it has been investigating the incidents since mid-October and is coordinating preventive and remediation measures across every potentially impacted industry. The agency said it is aware of compromises involving Danfoss AK-SM and AK-SC series controllers, as well as Copeland xweb and Dixell xweb controllers, and has issued guidance urging security teams to take these devices off the open internet, noting that thousands remain exposed and visible to potential attackers. Researchers at Claroty published a report in August outlining critical flaws in Danfoss controllers that could allow remote code execution, enabling attackers to manipulate key functions including temperature. In the United States, the Health Information Sharing and Analysis Center (Health-ISAC) sent an advisory to its members warning of the potential risk of attack, according to the group's chief security officer, Errol Weiss.

   Remediation

   ANSSI's guidance urges organizations to remove exposed Danfoss and Copeland/Dixell xweb controllers from direct internet access, given that thousands remain discoverable by attackers. Health-ISAC's advisory to U.S. healthcare members reflects a broader push for sector-specific monitoring of this refrigeration-targeting campaign as it spreads across food retail, military logistics, and now blood-supply infrastructure.

4. securityweek.com ↗ · pub. 05/11/2026 09:58 · coletado 05/11 12:00

   French Blood Bank EFS Cold-Chain Attack Contained; Ahold Delhaize Sees Up to €350M Hit from Fridge Hacks

   This article confirms the EFS/Coolworld cold-storage incident was contained with no blood product losses, and adds financial fallout from the related European fridge-sabotage wave: Dutch retailer Ahold Delhaize disclosed in its Q4 earnings that it expects the October cyberattack on its supermarket refrigeration systems to reduce sales by up to €250 million and cut operating income by up to €100 million, with CEO Franz Muller stating that while most disruption was contained within two weeks, work continues to fully restore normal operations.

   ler a análise desta fonte ocultar

   This article confirms the EFS/Coolworld cold-storage incident was contained with no blood product losses, and adds financial fallout from the related European fridge-sabotage wave: Dutch retailer Ahold Delhaize disclosed in its Q4 earnings that it expects the October cyberattack on its supermarket refrigeration systems to reduce sales by up to €250 million and cut operating income by up to €100 million, with CEO Franz Muller stating that while most disruption was contained within two weeks, work continues to fully restore normal operations.

   A cyberattack on the French Blood Establishment (EFS) attempted to raise temperatures at three cold-storage plasma sites to extremely high levels, but monitoring systems detected the anomaly in time and no blood products or samples were compromised. The attack targeted refrigeration equipment supplied by Coolworld, which confirmed it was aware of the incident and said it stemmed from a component supplied by a third-party provider outside its direct control, affecting only a limited number of units. France's national cybersecurity agency (ANSSI) and the Health Ministry are investigating. Separately, Dutch supermarket chain Ahold Delhaize, hit by a related wave of fridge and freezer attacks in mid-October across France, Belgium and the Netherlands, disclosed in its quarterly earnings that it expects the incident to cut fourth-quarter sales by as much as €250 million and reduce operating income by up to €100 million.

   Technical Details

   French weekly newspaper Le Canard Enchaîné, which first reported the cyberattack, said that the attack had attempted to reset temperatures that normally are at minus 30 Celsius (minus 22 Fahrenheit) to as high as 110 C (230 F). The cyberattack hit a supplier of refrigeration equipment at three EFS sites. The products stored were bags of plasma intended for transfusions and plasma used to manufacture medicines, and were either transferred or secured, the EFS statement said. The company supplying the refrigeration equipment, Coolworld, said in a statement it "is aware" of the cybersecurity incident. "The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld's direct control," the statement said. The company said only a limited number of units were affected and it was taking "appropriate measures."

   Remediation

   One of the chains hit in that earlier incident, Dutch supermarket chain Ahold Delhaize, said Wednesday that it expected the cyberattack to reduce its sales in the fourth quarter by as much as 250 million euros ($281 million), and crimp its operating income for the period by up to 100 million euros. "While most of the disruption was contained within two weeks, work continues to fully restore our normal operations," CEO Franz Muller said. "As we all recognize, cyber threats are an increasingly harsh reality of doing business today," he said in a statement released with Delhaize's quarterly earnings. The company had earlier blamed "malicious actions by others" and proactively took some of its systems offline, including websites and apps for its various brands in Europe as well as in the United States.

5. olhardigital.com.br ↗ · pub. 04/11/2026 16:10 · coletado 04/11 18:02

   Attack on Coolworld Refrigeration Systems Threatens French Blood Plasma Supply

   The article adds official warnings that preceded and framed the Coolworld/EFS incident: ANSSI director-general Vincent Strubel cautioned in October 2026 that refrigeration facilities, including those storing medical resources, could become cyberattack targets, while NCSC chief executive Richard Horne, at the launch of the UK's *State of the Cyber Nation* report, warned that electricity distribution, water/dam control systems, industrial production lines and refrigeration controls are all at risk, describing the UK's cyber vulnerabilities as a "digital Tower of Pisa" and predicting a possible unprecedented surge in incidents.

   ler a análise desta fonte ocultar

   The article adds official warnings that preceded and framed the Coolworld/EFS incident: ANSSI director-general Vincent Strubel cautioned in October 2026 that refrigeration facilities, including those storing medical resources, could become cyberattack targets, while NCSC chief executive Richard Horne, at the launch of the UK's State of the Cyber Nation report, warned that electricity distribution, water/dam control systems, industrial production lines and refrigeration controls are all at risk, describing the UK's cyber vulnerabilities as a "digital Tower of Pisa" and predicting a possible unprecedented surge in incidents.

   Hackers attacked refrigeration systems used to store blood plasma in France between November 1 and 2, 2026, altering the temperature programming of freezers operated for the Établissement Français du Sang (EFS), the French national blood service. The target was Coolworld, a refrigeration supplier for EFS, and the incident followed similar attacks on supermarket freezers in Europe weeks earlier. According to the site Cyberattaque, cited by Cyber Security News, attackers reprogrammed equipment to raise temperatures from -30°C to 110°C, though it is unclear whether freezers actually reached that level. France's Ministry of Health said the attack caused no serious operational consequences, as the temperature changes were quickly detected and corrected, though it has not disclosed the number of facilities affected, the duration of the disruption, the temperatures actually reached, or whether any blood stock had to be discarded. The attackers reportedly did not directly compromise medical facilities but instead breached third-party maintenance systems responsible for controlling freezer temperatures, illustrating how a single compromised maintenance provider can expose refrigeration systems across multiple clients, including those used for essential services.

   Technical Details

   The attack occurred two weeks after Vincent Strubel, director-general of France's ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information), warned in October 2026 that refrigeration facilities, including those used to store medical resources, could become targets of cyberattacks. In the United Kingdom, Richard Horne, chief executive of the NCSC (National Cyber Security Centre), also flagged the fragility of organizations' and supply chains' technological and operational structures. During the launch of the State of the Cyber Nation report, Horne pointed to several systems that could be exploited in cyberattacks, including electricity distribution, water facility floodgates and dam operations, industrial production lines, and refrigeration controls. Horne described the moment as a crossroads for British cybersecurity, compared existing vulnerabilities to a "digital Tower of Pisa," and warned that the UK faces the possibility of an unprecedented rise in cyber incidents in the months ahead.

6. securityaffairs.com ↗ · pub. 04/11/2026 16:01 · coletado 04/11 18:00

   Cyberattack Disrupts Refrigeration Monitoring at Three French Blood Banks Amid Europe-Wide Cold-Chain Sabotage

   This earlier-stage report confirms that remote access to the affected EFS refrigerators was disabled as a containment measure and situates the blood bank incident within a broader context of EU concern over connected infrastructure vulnerabilities heightened since Russia's 2022 invasion of Ukraine, details not previously captured in the case record; it otherwise restates the already-known facts about the three affected EFS facilities and the parallel European supermarket refrigeration attacks, without naming Coolworld, Danfoss controllers, or specific temperature values disclosed in later reporting.

   ler a análise desta fonte ocultar

   This earlier-stage report confirms that remote access to the affected EFS refrigerators was disabled as a containment measure and situates the blood bank incident within a broader context of EU concern over connected infrastructure vulnerabilities heightened since Russia's 2022 invasion of Ukraine, details not previously captured in the case record; it otherwise restates the already-known facts about the three affected EFS facilities and the parallel European supermarket refrigeration attacks, without naming Coolworld, Danfoss controllers, or specific temperature values disclosed in later reporting.

   A cyberattack disrupted refrigeration monitoring and control systems at three regional facilities of the French Blood Establishment (EFS) overnight between Sunday and Monday, coinciding with attacks on supermarket refrigeration systems in eight European countries, including Sweden and Belgium. The French Health Ministry confirmed the incident affected cold storage room monitoring and control systems but did not impact blood supplies, as staff moved blood products to unaffected refrigerators after receiving alerts. Remote access to the affected refrigerators was subsequently disabled, and the situation was reported under control within days. The incident follows an earlier October attack in which hackers allegedly seized control of cooling units at hundreds of French supermarkets, causing fires and food losses, underscoring a broader pattern of attacks against operational technology (OT) and refrigeration systems across Europe.

   Technical Details

   Investigations are ongoing to determine how attackers gained access, which equipment was affected, and when systems can safely return to normal operation. The article frames the incident as part of a wider exposure of OT and remote management platforms connected to corporate networks, which can allow attackers to interfere with physical processes such as refrigeration rather than simply stealing data.

   Remediation

   The report recommends that organizations operating critical infrastructure identify exposed systems, restrict remote access, enforce strong authentication, segment operational networks, and monitor changes to equipment settings, alongside tested manual procedures to maintain essential services when digital systems become unavailable or untrustworthy.

7. bleepingcomputer.com ↗ · pub. 04/11/2026 15:02 · coletado 04/11 16:00

   EFS Confirms Coolworld Refrigeration Hack Raised Blood Storage Temperatures in France

   This article adds EFS's own confirmation statement (November 3) detailing that the November 2 incident raised temperature and defrost thresholds, and that plasma intended for transfusions and medicine manufacturing was transferred or secured without loss. It also adds a statement from Belgian refrigeration company Sabcobel that the November European supermarket attacks exploited the same vulnerability as October's French supermarket wave, specific examples of affected Swedish stores (heat generation, 50°C readings), and detail on CISA's 2025 disclosure of CVE-2025-41450 and CVE-2025-41451 affecting Danfoss AK-SM 8xxA controllers, while noting it remains unconfirmed whether these flaws are being exploited in the current attacks.

   ler a análise desta fonte ocultar

   This article adds EFS's own confirmation statement (November 3) detailing that the November 2 incident raised temperature and defrost thresholds, and that plasma intended for transfusions and medicine manufacturing was transferred or secured without loss. It also adds a statement from Belgian refrigeration company Sabcobel that the November European supermarket attacks exploited the same vulnerability as October's French supermarket wave, specific examples of affected Swedish stores (heat generation, 50°C readings), and detail on CISA's 2025 disclosure of CVE-2025-41450 and CVE-2025-41451 affecting Danfoss AK-SM 8xxA controllers, while noting it remains unconfirmed whether these flaws are being exploited in the current attacks.

   France's national blood service Établissement Français du Sang (EFS) confirmed that a cyberattack on its refrigeration supplier Coolworld Rentals raised temperature and defrost thresholds at three of its cold-storage facilities on November 2, 2026, threatening stored blood products. EFS said it was not directly targeted; the attackers compromised Coolworld's remote monitoring software by exploiting a vulnerability in a third-party component outside the vendor's control. EFS's monitoring and alarm systems detected the anomaly quickly, allowing staff to repair equipment or transfer plasma bags intended for transfusions and medicine manufacturing to other facilities, with no health impact or loss of blood products reported. The incident is part of a wider European wave of refrigeration sabotage that previously disrupted 250 to 350 French supermarkets in October and more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia this month.

   Technical Details

   Belgian refrigeration company Sabcobel stated that the attackers behind the November incidents exploited the same vulnerability used in October's attacks against French supermarkets. The earlier supermarket attacks reportedly compromised refrigeration controllers running older Danfoss software and remotely activated automatic defrosting functions, raising temperatures and forcing stores to discard fresh and frozen products, targeting Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers. In the second wave, some refrigeration systems were shut down entirely, while others had their temperature settings changed remotely; at one Swedish supermarket the system reportedly began generating heat, while another store reported temperatures changed to 50°C (122°F). Separately, CISA disclosed in 2025 two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451, which could allow attackers to bypass authentication and execute commands remotely on vulnerable systems, potentially giving them control over refrigeration equipment, though it has not been confirmed whether these vulnerabilities are being exploited in the attacks.

   Remediation

   EFS said its technical teams are working with France's national cybersecurity agency ANSSI and the Ministry of Health, and has strengthened monitoring of refrigeration equipment and temperatures. Organizations relying on third-party refrigeration or cold-chain monitoring vendors should maintain independent temperature verification, restrict remote administrative access to controllers, and patch known Danfoss AK-SM/AK-SC vulnerabilities to reduce exposure to this ongoing campaign.

8. helpnetsecurity.com ↗ · pub. 04/11/2026 10:36 · coletado 04/11 12:01

   French Blood Banks Detect and Reverse Cold-Room Sabotage Tied to Refrigeration Provider Hack

   This report adds that three EFS blood banks specifically detected and reversed the cold-room temperature anomaly, that the affected cold rooms serve approximately 1,900 healthcare facilities across France, and that the compromise of the unnamed refrigeration provider occurred on November 2, 2026, coinciding with the wider European supermarket refrigeration attack wave. It also introduces new technical intelligence from researcher Xavier Bellekens of Lupovis: starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors from ASNs linked to bullet-proof hosting and Russian adversaries, most using publicly documented factory-default credentials, with probing continuing until October 30 in an apparent preparation for a synchronized attack.

   ler a análise desta fonte ocultar

   This report adds that three EFS blood banks specifically detected and reversed the cold-room temperature anomaly, that the affected cold rooms serve approximately 1,900 healthcare facilities across France, and that the compromise of the unnamed refrigeration provider occurred on November 2, 2026, coinciding with the wider European supermarket refrigeration attack wave. It also introduces new technical intelligence from researcher Xavier Bellekens of Lupovis: starting October 20, 2026, his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors from ASNs linked to bullet-proof hosting and Russian adversaries, most using publicly documented factory-default credentials, with probing continuing until October 30 in an apparent preparation for a synchronized attack.

   Three French blood banks under the Établissement Français du Sang (EFS) detected and reversed a potentially destructive temperature spike in their cold rooms after a cyberattack hit a refrigeration equipment provider used by EFS, the only civilian blood collection and transfusion organization in France. EFS said it was not directly targeted, but anomalies changed operating parameters on cold rooms running the provider's solution, setting temperature and defrost thresholds to very high levels. EFS's monitoring and alarm systems caught the anomalies in time, no blood samples or products were altered, and affected products were moved to other facilities while collection and distribution continued unaffected. These cold rooms store blood and plasma before distribution to roughly 1,900 healthcare facilities across France, and EFS is working with ANSSI and the Ministry of Health while stepping up monitoring.

   Technical Details

   EFS said the still-unnamed equipment provider was compromised on November 2, 2026, coinciding with a broader wave of cyberattacks on refrigeration units at European supermarkets, with initial reports of affected stores in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia, the Netherlands, Portugal and Romania. Attribution for this wider campaign remains unknown. Xavier Bellekens, CEO of Lupovis, told Help Net Security that starting October 20 his company observed authentication attempts targeting Danfoss AK-SM refrigeration controller sensors, originating from ASNs previously categorized as bullet-proof hosting and used by Russian adversaries. Most of these attempts used publicly documented factory-default credentials, and the probing continued until October 30, suggesting an effort to compromise as many devices as possible ahead of a synchronized attack.

   Remediation

   Organizations relying on third-party refrigeration or cold-chain monitoring providers should ensure independent temperature monitoring and alarm thresholds that are not solely dependent on vendor-managed systems, and should audit internet-facing refrigeration controllers such as Danfoss AK-SM for default or weak credentials, restricting remote management access where possible.

9. infosecurity-magazine.com ↗ · pub. 04/11/2026 09:52 · coletado 04/11 10:01

   Coolworld Confirms Cyberattack on Refrigeration Systems After French Blood Service Cold Rooms Hit 110°C

   Coolworld itself publicly confirmed the cyberattack on November 4, 2026, stating it involved remote monitoring software and affected only a limited number of its units, and attributing the underlying vulnerability to a third-party component outside its direct control. EFS president Frédéric Pacoud also gave a direct statement on the potential impact and the successful early detection, adding confirmation that no blood products were compromised and that EFS's own IT systems were not affected.

   ler a análise desta fonte ocultar

   Coolworld itself publicly confirmed the cyberattack on November 4, 2026, stating it involved remote monitoring software and affected only a limited number of its units, and attributing the underlying vulnerability to a third-party component outside its direct control. EFS president Frédéric Pacoud also gave a direct statement on the potential impact and the successful early detection, adding confirmation that no blood products were compromised and that EFS's own IT systems were not affected.

   Dutch refrigeration contractor Coolworld confirmed a cyberattack on November 4, 2026, after French newspaper Le Canard enchaîné reported that unauthorized actors took control of refrigeration controllers in cold-storage rooms operated by France's national blood service Établissement Français du Sang (EFS), pushing temperatures from a normal -30°C to as high as 110°C overnight between November 1 and 2. The affected facilities are located in the Burgundy and Franche-Comté region and store blood samples and plasma intended for transfusions. An on-call EFS technician noticed the abnormal temperature rise overnight, allowing the issue to be caught before it caused any operational impact. The French Ministry of Health and EFS president Frédéric Pacoud both stressed that no blood products were compromised thanks to early detection.

   Technical Details

   Coolworld, which rents temperature-control equipment in France, Germany, Ireland, the Netherlands and the UK, said it was "aware of the cybersecurity incident involving remote monitoring software used in refrigeration systems" and that it "responded promptly by implementing the appropriate measures," though it did not disclose what those measures were. The company stated that only a limited number of its units were affected and said the reported vulnerability "concerns a component supplied by a third-party provider and not directly controlled by Coolworld." EFS president Frédéric Pacoud told BFMTV the service "could have lost samples or bags of plasma intended to treat patients" had the early warning not occurred, adding there was no compromise to the safety of blood products. At the time of reporting, nothing indicated that EFS's own IT systems were affected by the attack, and EFS had not responded to a request for comment.

   Remediation

   The incident underscores the exposure created by third-party refrigeration and remote-monitoring vendors with access into healthcare cold-chain infrastructure, even when the healthcare organization's own network is untouched. Independent temperature monitoring and rapid alarm escalation, as demonstrated by the EFS on-call technician's detection, remain critical compensating controls while the specific vulnerable component supplied to Coolworld is identified and remediated.

10. theregister.com ↗ · pub. 04/11/2026 08:56 · coletado 04/11 10:00

    EFS Blood Service Confirms Refrigeration Supplier Hack as Cold-Chain Attacks Spread Across Europe and UK

    The Register's report confirms EFS's own statement that its systems were not directly breached, only the refrigeration supplier's, and details the broader context: the attack wave has now spread to Estonia, Finland, Germany, Portugal, Romania, and the Netherlands beyond the initial Belgium, Ireland, Luxembourg, and Sweden; the UK's NCSC chief acknowledged a couple of impacts on the UK food supply chain, with the meat suppliers association AIMS reporting member fridges defrosting; and the article places the EFS incident a month after an earlier supermarket-focused wave hitting Carrefour, Coopérative U, Intermarché, and Monoprix, as well as a prior August incident at US military commissaries.

    ler a análise desta fonte ocultar

    The Register's report confirms EFS's own statement that its systems were not directly breached, only the refrigeration supplier's, and details the broader context: the attack wave has now spread to Estonia, Finland, Germany, Portugal, Romania, and the Netherlands beyond the initial Belgium, Ireland, Luxembourg, and Sweden; the UK's NCSC chief acknowledged a couple of impacts on the UK food supply chain, with the meat suppliers association AIMS reporting member fridges defrosting; and the article places the EFS incident a month after an earlier supermarket-focused wave hitting Carrefour, Coopérative U, Intermarché, and Monoprix, as well as a prior August incident at US military commissaries.

    France's Établissement Français du Sang (EFS), the national civilian blood service, confirmed that attackers compromised a refrigeration supplier used to control cold-storage equipment holding blood samples and frozen plasma intended for transfusion. EFS said its own systems were not directly targeted and that monitoring and alarm systems allowed rapid detection, so no blood products or samples were compromised; affected units were brought under control, neutralized, or had their contents preventively moved to other facilities. According to reports cited in the article, attackers changed cold-room temperature settings from -30°C to 110°C, though this does not confirm the equipment or its contents actually reached that temperature. EFS notified ANSSI, France's cybersecurity agency, and the Ministry of Health. The incident is part of a wider wave of attacks on refrigeration systems that, a day earlier, hit supermarket chains across Europe by remotely triggering defrost cycles, spoiling food stock.

    Technical Details

    Stores across Belgium, Ireland, Luxembourg, and Sweden were the first to report issues, although cases from Estonia, Finland, Germany, Portugal, Romania, and the Netherlands have since been confirmed. Richard Horne, chief executive of the UK's National Cyber Security Centre (NCSC), said he was aware of "a couple of impacts" in the UK's own food supply chain, and the British Association of Independent Meat Suppliers (AIMS) told the BBC that some of its more than 300 members had become "collateral" in the attacks, with two reporting that their fridges had begun defrosting. The latest wave of cold-store attacks comes a month after the first, which affected French supermarket chains Carrefour, Coopérative U, Intermarché, Monoprix, and others. Some affected chains identified Danfoss controllers in their systems; others said they did not use the company's equipment, and CERT-FR published an advisory at the time urging organizations to remediate vulnerabilities in Danfoss AK-SM and AK-SC controllers. Whether the EFS intrusion used the same access route as the supermarket campaign remains unclear, and the attackers behind the refrigeration attacks have not been identified. The attacks in France followed reports of compromises at US military commissaries, which also led to food wastage in August.

    Remediation

    The case underscores the risk of third-party refrigeration and cold-chain contractors as an attack path into healthcare and food-supply operations, even without a direct breach of the victim's own network. Organizations relying on externally managed refrigeration controllers should enforce independent temperature monitoring, segment vendor remote-access connections, patch known Danfoss AK-SM/AK-SC vulnerabilities per CERT-FR guidance, and ensure alarm escalation can catch anomalous setpoint changes before stored products are compromised.

11. gbhackers.com ↗ · pub. 04/11/2026 01:59 · coletado 04/11 02:00 primeiro registro

    Cyberattack on Coolworld Reprograms EFS Blood Service Freezers From -30°C to 110°C

    ler a análise desta fonte ocultar

    Hackers compromised refrigeration equipment operated by Coolworld, a cooling contractor for France's national blood service Établissement Français du Sang (EFS), altering freezer setpoints from approximately -30°C to 110°C overnight between November 1 and 2, 2026. The intrusion hit cold-storage sites in the Bourgogne-Franche-Comté region and was first reported by Le Canard enchaîné after an on-call technician noticed abnormal temperature readings. France's Health Ministry said staff intervened in time and that the incident caused no significant operational disruption. EFS initially described the affected materials as donor samples used for transfusion monitoring, but later confirmed that frozen plasma intended for patient transfusions was also involved.

    Technical Details

    The reported 110°C value is a controller setpoint — an instruction given to the refrigeration system — rather than a confirmed internal temperature of the storage compartments or the plasma bags themselves; neither actual product temperatures nor exposure duration has been disclosed. Investigators have not publicly identified the initial access method, any exploited vulnerability, the controller models involved, or the attackers responsible, and remote manipulation of refrigeration parameters remains consistent with the reported behavior without confirming a specific exploit. No confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft have been reported. The incident follows a wave of attacks on French supermarket refrigeration systems that abused automatic defrost functions to cause prolonged heating, and a broader European refrigeration sabotage campaign affecting Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands, for which ANSSI issued warnings about Danfoss AK-SM/AK-SC controllers and Copeland and Dixell XWEB systems; however, no evidence confirms these specific product families were deployed at the affected EFS facilities, and the technical link between the supermarket wave and the Coolworld intrusion remains unproven.

    Remediation

    The incident highlights risk arising from refrigeration contractors' maintenance connectivity, which can expose medical cold-chain systems even without a direct breach of the healthcare organization's primary network. Recommended priorities include limiting exposed management interfaces and administrative connections on OT/refrigeration controllers, maintaining independent temperature monitoring separate from vendor-managed systems, and ensuring alarm and escalation procedures can detect dangerous deviations before stored medical products become unusable. Independent verification of actual product conditions is essential whenever a suspected cold-chain interruption follows a controller compromise.