Attack on refrigeration supplier raised cold-storage temperatures at three French blood service sites

France's national blood service says a cyberattack on its refrigeration supplier pushed temperature and defrost thresholds to extremely high levels in cold-storage chambers at three of its facilities. The incident happened on November 2, according to the Établissement français du sang (EFS), which put out a statement the next day.

EFS says it wasn't the target. The supplier was. Coolworld Rentals, a European refrigeration equipment provider, confirmed a cybersecurity incident involving remote monitoring software that affected a limited number of its units. Coolworld says the attackers exploited a vulnerability in a third-party component that was outside its direct control, and that it responded promptly. It won't discuss individual customers.

The chambers hold blood products before they go to hospitals, plus biological samples kept by EFS. Its monitoring and alarm systems caught the temperature change, and staff either fixed the equipment or moved products elsewhere. EFS says no health impact has been identified and no loss of blood products has been reported. Plasma bags for transfusions and plasma used to make medicines were transferred or secured. Collection and distribution carried on without interruption.

EFS is working with ANSSI, France's cybersecurity agency, and the Ministry of Health, and has tightened monitoring of refrigeration equipment and temperatures.

The attack fits a run of incidents against cooling systems in Europe. In October, attacks disrupted refrigeration at an estimated 250 to 350 French supermarkets, reportedly by abusing older Danfoss controllers and triggering defrost cycles. A second wave this month hit more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with some systems shut down and others retuned remotely.

Nobody has publicly tied this incident to a specific flaw. CISA disclosed two vulnerabilities in Danfoss AK-SM 8xxA controllers in 2025, but it hasn't been confirmed that they're being exploited in these attacks, and the advisory doesn't say which component Coolworld's supplier shipped.

For defenders running remote monitoring on cooling kit, the useful checks are the ones EFS's own response leaned on: whether alarms on temperature and defrost settings actually fire, who can reach the controller from outside, and whether there's a plan for moving stock when a chamber misbehaves.