November 3, 2026: The Établissement français du sang (EFS), France's national blood service, said a cyberattack on its refrigeration equipment supplier changed temperature and defrost settings in cold-storage chambers at three of its facilities on November 2. EFS says no blood products were lost and no health impact has been identified. The catalog entry records the details.
What happened
EFS says it was not itself the target. The attackers reached its refrigeration supplier and pushed temperature and defrost thresholds to extreme levels in cold rooms at three sites. Monitoring and alarms caught the change quickly. Staff repaired equipment or moved products, and plasma for transfusion and for medicine production was transferred or secured. Blood collection and distribution carried on without interruption.
EFS has not named the supplier. Refrigeration rental firm Coolworld Rentals separately confirmed an incident involving its remote-monitoring software on a limited number of units, which it blames on a flaw in a third-party component. It has not been confirmed as EFS's supplier.
Part of a wider wave
In October, attackers remotely triggered defrost cycles and raised temperatures at an estimated 250 to 350 French supermarkets, including Intermarché, Carrefour Market, Monoprix, Leclerc and Super U stores. Reports linked those attacks to older Danfoss and Copeland/Dixell refrigeration controllers left reachable from the internet. See our coverage of the supermarket attacks and the Intermarché and Système U entries. In early November a second wave hit more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. The EFS incident shows the same kind of attack reaching healthcare cold chains.
Verified and unverified
- Confirmed by EFS: the date, the three affected sites, the changed settings, the lack of product loss, and that the supplier was the entry point. EFS is working with France's cybersecurity agency ANSSI and the Ministry of Health.
- Unknown: the supplier's name, the attackers, how the supplier was compromised, and whether the attack is directly linked to the supermarket campaign.
No data theft has been reported. This is an operational attack on equipment, not a data breach.
Who is at risk
Blood donors and patients are not known to be at risk: EFS reports no loss of blood products and no health impact. The wider risk is for any organisation that relies on remotely monitored refrigeration, including hospitals, pharmacies, labs, vaccine stores and food retailers. Equipment run by a supplier is part of your attack surface even if you never connect to it yourself.
What to do (for organisations)
- Ask refrigeration and building-management suppliers whether their remote-monitoring platforms can change setpoints, and who can log in.
- Make sure controllers are not directly reachable from the internet. CERT-FR has advised disconnecting or filtering access to affected controllers.
- Use independent temperature alarms that do not rely on the supplier's platform, and test them.
- Have a plan to move stock quickly, as EFS did.
- Check controller firmware against published advisories, including CISA's 2025 Danfoss AK-SM advisories (CVE-2025-41450 and CVE-2025-41451).
Sources
- BleepingComputer, "Cyberattack disrupts blood storage refrigeration systems in France," November 4, 2026
- EFS website (statement published November 3, 2026, in French)
Sourcing note: EFS's statement is quoted in translation by BleepingComputer. The Coolworld Rentals link to EFS is not confirmed.