VULNpocalypse
HighSupply chainOngoing

French blood bank cold rooms tampered with via refrigeration provider, 110°C setpoints reported

Attackers who hit a refrigeration provider altered cold room settings at three French blood service sites, but EFS says no products were lost.

Published
Exploitation
Yes, EFS confirmed that temperature and defrost thresholds in its cold rooms were set to very high levels after a supplier was compromised, but the entry method is not confirmed

What happened

The EFS said on Tuesday that it was not directly targeted, but that anomalies changed the operating parameters of cold rooms equipped with its provider’s solution, with temperature and defrost thresholds set to very high levels (Help Net Security). A spokesperson told The Record that three sites were affected and could not name the specific sites or the manufacturer or model of the control systems (The Record).

Reports say attackers changed settings from about -30°C to 110°C. That figure is a setpoint, meaning the temperature requested through a control system, and it does not show that freezer interiors, samples or plasma bags reached that temperature (Cybersecurity News, The Register). The actual temperatures reached, the number of affected units and the length of the disruption are not disclosed (Cybersecurity News).

EFS says its monitoring and alarm systems identified the anomalies quickly. Depending on the circumstances, affected equipment was either brought under control or neutralized, and products were preventively moved to other facilities (The Register). EFS reported no health impacts and no losses of blood products (The Record). The affected equipment held blood samples and frozen plasma, including plasma intended for transfusion (The Register). EFS notified ANSSI and the Ministry of Health (The Register).

Timing: the incident reportedly happened overnight between November 1 and 2, 2026 (Cybersecurity News, The Hindu). EFS says the provider was hit on November 2, 2026 (Help Net Security).

The provider’s name is disputed. Cybersecurity News and The Hindu name Coolworld, citing reporting by Cyberattaque and Le Canard enchaîné (Cybersecurity News, The Hindu). The Register reports that EFS did not name the supplier publicly (The Register). Treat the Coolworld name as not confirmed by EFS.

Wider context:

  • This is the second wave of attacks on refrigeration control systems. The first, in October, hit French supermarkets and caused spoiled stock through remote defrosting (The Record).
  • The Record reports at least 11 countries affected in the latest wave and calls this the first reported case affecting a healthcare organisation (The Record).
  • No group has claimed responsibility. UK authorities have not attributed the incidents, and Belgium’s cybersecurity agency said it may never be possible to identify who was behind them (The Record).
  • Whether the EFS incident used the same access route as the supermarket attacks is unclear. Some affected chains identified Danfoss controllers and others said they did not use that company’s equipment (The Register).
  • Lupovis CEO Xavier Bellekens said the firm saw authentication attempts against Danfoss AK-SM controllers from October 20 to October 30, from ASNs previously categorized as bullet-proof hosting used by Russian adversaries, mostly with publicly documented factory-default credentials (Help Net Security). No public evidence links this activity or exposed Danfoss systems to the EFS incident (Cybersecurity News).

Investigators have not publicly identified a controller model, exploited vulnerability or stolen maintenance account, so claims that a specific Danfoss flaw caused the EFS incident go beyond the evidence (Cybersecurity News). No confirmed theft of donor information has been reported (Cybersecurity News).

Am I affected?

You may be exposed if any of these apply. Exposure is not proof of compromise.

  • You operate networked refrigeration or cold room controllers, especially with management interfaces reachable from the internet. An October 12 CERT-FR alert confirmed numerous compromises involving Danfoss AK-SM and AK-SC controllers, plus Copeland and Dixell XWEB systems (Cybersecurity News).
  • A refrigeration or maintenance contractor manages your equipment remotely. EFS describes the attack as reaching it through a third-party provider (The Record).
  • You store medical products, samples or food in cold rooms. Fresh frozen plasma requires storage at -25°C or below, and a prolonged rise could make supplies unsuitable for transfusion (Cybersecurity News).
  • You are a retailer or food supplier in an affected country. Reported countries are Belgium, Estonia, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, Portugal, Sweden and the United Kingdom (The Record).

Search results alone do not show whether a given internet-facing device is vulnerable or compromised (Cybersecurity News). Which controller EFS used is not confirmed.

What to do now

  1. Remove direct internet access to refrigeration and cold room management interfaces. CERT-FR warned operators against exposing them, and says remote access should be restored only through secure VPNs or protected networks (Cybersecurity News).
  2. Change default passwords on every controller and enable the applicable security settings. Lupovis saw attempts using publicly documented factory-default credentials (Help Net Security).
  3. Review full device configurations and check setpoints, defrost thresholds and defrost schedules for unexpected changes, as CERT-FR recommends (Cybersecurity News).
  4. Apply firmware updates on supported equipment. CERT-FR urged remediation of vulnerabilities in Danfoss AK-SM and AK-SC controllers (The Register). Specific fixed versions are not confirmed in the sources.
  5. Keep independent temperature monitoring and alarms that do not depend on the controller’s own setpoint. Controller settings, measured air temperatures and product temperatures are separate readings, and EFS credits its monitoring and alarms for catching the anomalies (Cybersecurity News, Help Net Security).
  6. Ask your refrigeration suppliers whether they were affected, how they access your equipment, and what accounts and credentials they use. Be ready to move products to other facilities if anomalies appear, as EFS did (The Register).
  7. Watch for updates. The cause, attacker and access route are not confirmed, and more retailers have reported disruption since the first disclosures (The Register).

Sources