User:Louis/French Blood Establishment cold-room cyberattack 2026

A cyberattack on a refrigeration supplier remotely raised the temperature & defrost thresholds of cold rooms storing plasma at three sites of Établissement français du sang (EFS), France's public blood service, to high temperatures on November 2, 2026. The rooms held bags of plasma for transfusion & for making medicines; EFS said its monitoring & alarm systems identified the anomalies quickly, the products were moved to other installations as a precaution, & no loss of blood products was to be reported.

Le Canard enchaîné, a French weekly newspaper, named the supplier as Coolworld, a company that rents out refrigeration & heating solutions; Coolworld said the vulnerability "currently being reported in the media relates to a component from a third-party supplier". An October 2026 alert from CERT-FR, the incident response center of France's cybersecurity agency, recommended removing remote controllers of refrigeration installations from the internet; according to news agency Agence France-Presse (AFP), the Health Minister's office said technical investigations were continuing.

Plasma cold rooms reprogrammed at three EFS sites

EFS dates the incident to November 2, 2026, when one of its refrigeration equipment providers suffered a cybersecurity incident that hit the supervision & control installations of cold rooms at three EFS sites. Regional television channel France 3 Normandie reported that the systems allowing remote control of the rooms were the ones manipulated. EFS said it was not directly targeted by the incident. According to Le Canard enchaîné as reported by Reuters, EFS refrigeration systems were targeted overnight from Sunday to Monday by a cyberattack aimed at driving up the temperatures of the installations where donor samples are stored.

At its preparation & distribution sites, EFS keeps blood products in cold rooms before they are delivered to health facilities, along with samples for its biobanks, its collections of biological samples.

The site in Besançon is one of the three hit. News site L'Essentiel de l'Éco reported that Besançon is the only site concerned in Bourgogne-Franche-Comté. France 3 Normandie reported, citing its own information, that the cold room at Bois-Guillaume in Seine-Maritime is another of the three sites.

Temperature and defrost settings

EFS said anomalies were reported that altered the operating parameters of the cold rooms, & that "des seuils de température et de dégivrage ont été portés à de très hautes températures" (which the Associated Press rendered as "temperature and defrosting thresholds were raised to extremely high levels"). A defrost setting lets a commercial refrigeration system clear ice buildup.

Le Canard enchaîné, which first reported the cyberattack, wrote that the cold rooms, where donor samples are kept at −30 °C, "ont été programmées pour atteindre 110 °C" (in English: were programmed to reach 110 °C). According to Euronews, EFS said that temperature was never reached.

Cyber Security News reported that the reported 110 °C figure describes a setpoint, meaning the temperature requested through a control system. Security news site Hackread reported that EFS confirmed its operating thresholds had been altered but did not publish the 110 °C figure itself.

Stored plasma and samples

The affected equipment held bags of plasma for transfusion & bags of plasma for fractionation to make medicines, EFS said. Commission Directive 2004/33/EC defines plasma as "the liquid portion of the blood in which the cells are suspended". Fractionation is the industrial operation that extracts medicines from plasma. The 2005 recommendations of the World Health Organization (WHO) describe it as a large-scale process by which plasma is separated into individual protein fractions that are further purified for medicinal use.

According to the Canard, EFS first said the rooms held samples kept under a health-monitoring scheme for blood transfusion, before acknowledging that "du plasma congelé destiné à la transfusion" (in English: frozen plasma intended for transfusion) had also been targeted. EFS president Frédéric Pacoud confirmed on French news channel BFMTV that there had been no breach of product safety, & stressed that EFS could have lost samples or bags of plasma meant to treat patients, French technology news site Numerama reported.

The WHO's 2005 recommendations state that "Plasma for fractionation should be stored at -20°C or colder."

Alarms, night staff and transfer of stock

According to the Canard, EFS said an on-call technician noticed a rise in temperature in the cold rooms during the night from Sunday to Monday. EFS said its monitoring & alarm systems let it identify the anomalies quickly & take the measures needed so that no sample or blood product would be altered. Depending on the case, the equipment concerned was brought under control without impact on products & samples, or neutralized, & the products stored in the rooms were moved to other installations as a precaution.

EFS spokesperson Charley Dubois told Reuters that EFS has staff round the clock because blood can be needed at any time, & that staff, warned about the problems by alerts, moved the blood to "other refrigerators that were not connected", Fox Business reported. EFS deputy director general Sophie Le Cam said on radio station RTL that supervision systems independent of the supplier let EFS react quickly. Stéphane Noël, EFS director for Hauts-de-France and Normandy, said EFS's specific monitoring systems are independent of the refrigeration contractor's & that "aucun produit n'a été altéré" (in English: no product was altered).

EFS said no health impact had been identified. It said the continuity of blood collection & distribution was guaranteed.

Coolworld

Le Canard enchaîné named Coolworld, which it called a service provider of EFS, as the company hit by the cyberattack. The newspaper reported that Coolworld maintains EFS storage containers, including in Bourgogne-Franche-Comté. EFS has not named the affected supplier, technology news site BleepingComputer reported. The EFS release describes the affected cold rooms as "équipées de la solution du prestataire de l’établissement" (in English: equipped with the solution of the establishment's provider).

Coolworld International B.V., which has its registered office in Waalwijk, the Netherlands, is a 100% subsidiary of Crystallum BV & is called "Coolworld Rentals" in its privacy policy. Coolworld describes itself as a rental organization of refrigeration & heating solutions, with branches in the Netherlands, Belgium, Germany, Austria, Switzerland & France. It says it has years of experience renting out temporary cooling & heating systems in industries including governments & pharmacy. L'Essentiel de l'Éco described it as a "loueur de chambres froides et de conteneurs frigorifiques" (in English: a renter of cold rooms & refrigerated containers).

Coolworld Rentals' statement of November 4, 2026, saying the vulnerability reported in the media "relates to a component from a third-party supplier".

Business Insider reported that commercial refrigeration is kept online so engineers can watch over it remotely for maintenance work. Coolworld's statement of November 4, 2026 said it was aware of the cybersecurity incident "involving remote monitoring software used in refrigeration systems early November 2026". The statement continued:

The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld’s direct control. Only a limited number of Coolworld units were affected, and Coolworld responded promptly and took appropriate measures.

Coolworld added that it was working closely with its customers where necessary and that "we do not comment on individual cases".

The statement names neither EFS nor the maker of the component, L'Essentiel de l'Éco reported. Cyber Security News wrote on November 4, 2026 that investigators "have not publicly identified a controller model, exploited vulnerability, or stolen maintenance account".

Consumer advocate Louis Rossmann argued in a November 5, 2026 video about cyberattacks on supermarket refrigerators, titled "Hackers turned supermarket smart-fridges into heaters & no law makes them fix it", that refrigerators should not be on the internet, because a refrigerator has one function: keeping its contents cold.

Background

Supermarket refrigeration attacks

Newsweek reported that the November 2 incidents at European supermarkets came weeks after an attack in France, in which hackers remotely altered refrigeration controls at hundreds of supermarkets & independent stores. France's finance minister said about 700 of the country's 10,000 supermarkets were affected. On November 2, 2026, retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands & Sweden reported problems with their refrigeration systems.

Newsweek reported that the public accounts do not identify the attacker in the Coolworld incident or establish that it used the same method as the supermarket intrusions. L'Essentiel de l'Éco reported that the hackers struck EFS on the same night as a second wave hit European supermarkets, & that neither EFS nor Coolworld had established a link between the two.

CERT-FR alert and Senate testimony

On October 12, 2026, CERT-FR, part of the Agence nationale de la sécurité des systèmes d'information (ANSSI), published alert CERTFR-2026-ALE-012 on remote controllers of refrigeration installations. CERT-FR added other targeted equipment on October 13 & updated its recommendations on October 16. The alert reported "nombreuses compromissions" (in English: many compromises) of Danfoss AK-SM & AK-SC series controllers, Copeland xweb & Dixell xweb.

Whether or not the equipment had been compromised, the alert recommended removing internet exposure of the units concerned & of every unit exposed on a public IP address, & restoring access only through a secure virtual private network (VPN) or a protected network. A VPN in this sense is an encrypted tunnel reserved for authorized users. For equipment that had not been compromised, the alert also called for checking the whole configuration, "notamment les plages de dégivrage" (in English: in particular the defrost ranges). In an emergency, filtering the source IP addresses of refrigeration contractors, the companies that monitor & adjust installations remotely, on a firewall was possible, but the alert said that solution "ne doit pas être considérée comme pérenne" (in English: must not be considered lasting); it warned that attack campaigns against this equipment were probably still under way.

On October 21, 2026, Vincent Strubel, director general of ANSSI, spoke about the supermarket fridges before the Senate's foreign affairs, defense and armed forces committee. He said the October 12 alert did not report a specific vulnerability, & that according to ANSSI's current analysis the vulnerabilities published by researchers over the two previous years were not the ones exploited. Strubel described "défauts de sécurisation élémentaires" (in English: basic security failings), starting with refrigeration equipment exposed directly on the internet & administered without particular protection, & weak passwords. He said ANSSI has published & updated a guide on securing industrial systems since 2014, whose first recommendation is not to expose them directly to the internet, that "À l'évidence, ces recommandations ne sont pas systématiquement respectées" (in English: evidently, these recommendations are not systematically followed) & that ANSSI currently has no power to compel supermarkets in how they deploy their fridges.

Asked about the health sector, Strubel said such refrigerators are found in supermarkets & in many other sectors, "notamment dans celui de la santé" (in English: in particular in health), "depuis les laboratoires de recherche jusqu'aux pharmacies qui stockent des vaccins" (in English: from research laboratories to pharmacies that store vaccines). He said ANSSI had worked with CERT Santé, the Health Ministry & all the actors concerned to make sure those fridges were protected. CERT Santé is the incident response center of the Agence du numérique en santé.

L'Essentiel de l'Éco reported on November 4, 2026 that nothing established at that stage that the component Coolworld blamed was among the products CERT-FR listed, because Coolworld had not named it. The same outlet reported that neither ANSSI nor EFS had said publicly whether Coolworld's equipment fell within that health-sector work, or whether EFS had been contacted between October 12 & November 1.

Health Ministry measures and investigation

Citing the office of Health Minister Stéphanie Rist, Reuters reported on November 4, 2026 that the situation was under control to date & under reinforced monitoring, & that no health impact had been identified at this stage on the stored blood products, which the office called "produits sanguins labiles". Le Canard enchaîné quoted the ministry as saying "Il y a zéro conséquence opératoire, car la situation a été repérée" (in English: there are zero operational consequences, because the situation was spotted).

According to AFP, Rist's office said the precautions put in place immediately included neutralizing remote access to the equipment concerned, reinforcing the monitoring of the installations & of the products' storage conditions, & transferring the products stored in those cold rooms to other installations. Technical investigations are continuing to establish the method & circumstances of the incident, the total number of devices potentially concerned, & the conditions & timetable for returning the affected installations to service, the office said. A new assessment of the situation will be released once the technical information gathered from the affected establishments has been consolidated, the ministry said.

In its November 3 release, EFS said its technical teams were working with ANSSI & the Health Ministry & that monitoring of the operation & temperatures of all its equipment had been reinforced. Sophie Le Cam said of such attacks that "ça devient la réalité de notre nouveau monde" (in English: it is becoming the reality of our new world), adding that EFS must raise its level of vigilance further.

See also

• Samsung Bespoke AI refrigerator update failure
• Security