Hackers manipulated refrigeration controls at three French blood-storage facilities Monday, setting temperatures and defrosting thresholds to dangerously high levels in the latest escalation of cyberattacks disrupting cooling equipment across Europe.
France’s national blood service, Établissement Français du Sang (EFS), confirmed the incident Tuesday. Its monitoring and alarm systems detected the changes before blood products were damaged, allowing staff to secure or relocate plasma used for transfusions and medicine manufacturing.
The attack that pushed plasma cold-room settings at France’s blood service to 110°C ran two suppliers deep, according to refrigeration vendor Coolworld, which blamed a component from a third-party provider. Few security programs look that far down the chain. A study found 78% of organizations say their programs cover less than half of their vendor ecosystem, including fourth and fifth parties, according to a 2026 SecurityScorecard survey.
EFS said the tampering, overnight from Nov. 1 to Nov. 2, hit monitoring and control systems its provider runs for cold rooms holding blood products and plasma. Le Canard enchaîné reported the settings were changed from -30°C to 110°C, a figure France’s health ministry confirmed Wednesday, Ara reported.
A setpoint is an instruction, not a reading. EFS said alarms and staff caught the changes before products were harmed.
“There was no impact on any of the products,” EFS President Frédéric Pacoud told franceinfo.
Two Suppliers Deep
EFS has not named its vendor. Franceinfo identified it as Coolworld, a temperature-control equipment provider. In a statement Wednesday, Coolworld said a limited number of its units were affected and blamed a component from a third-party provider outside its direct control. It did not name the component. SPB has asked Coolworld and EFS which component was involved and whether other customers were hit.
The precise attack method remains unknown. Neither EFS nor Coolworld has publicly identified the vulnerable software component, disclosed how attackers obtained access or established whether the supplier’s systems were compromised.
The incident highlights the security challenges posed by refrigeration controllers and remote maintenance equipment that often operate outside conventional endpoint protection.
“These automated controllers and remote maintenance gateways often expose themselves directly to the internet with legacy firmware, giving attackers a low-barrier vector to cause real-world physical havoc,” said Jamie Moles, senior technical manager at ExtraHop.
Sarah Cleveland, senior director of federal strategy at ExtraHop, warned that the risks extend beyond civilian healthcare and food distribution to military logistics.
“The recent disruption of refrigeration systems in civilian healthcare and base supply networks should serve as a reminder that OT ‘cold chain’ facilities are prime, highly vulnerable targets,” Cleveland said.
Attacks Spread Beyond Supermarkets
The blood-service incident follows a wave of refrigeration attacks that Security Point Break reported Monday, when hackers manipulated cooling equipment at supermarkets in Belgium, Sweden, Luxembourg and Estonia.
Some commercial freezers were set to 122°F (50°C), spoiling food and forcing retailers to discard inventory. The attacks followed an October campaign affecting approximately 700 French supermarkets.
About 700 French supermarkets were disrupted in October, according to Economy Minister Roland Lescure. On Nov. 2 and 3, grocery chains in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia reported similar overnight failures, according to SentinelLABS.
SentinelOne researcher Tom Hegel wrote on Tuesday that the French attacks appeared to involve internet-exposed refrigeration-management interfaces and weak passwords.
France’s cybersecurity agency, ANSSI, had previously identified exposed administrative interfaces as a likely factor in the October attacks. Those findings do not establish how attackers reached the blood-storage equipment.
Attribution is Still an Unknown
No group has claimed the EFS attack. Russian-aligned groups have a record of hitting operational technology, but SentinelLABS said evidence does not yet tie anyone to the European incidents. Attackers are also probing other internet-facing industrial gear this month, including Siemens industrial gateways running a flawed Node-RED build.
CERT-FR advises pulling refrigeration controllers off the public internet, reviewing defrost ranges and restoring remote access only through a VPN.
A cold room is now an endpoint. It deserves an owner on the security team.
