Cyberattack on refrigeration provider disrupts blood storage at three French facilities

France's national blood service, the Établissement français du sang (EFS), has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings in cold-storage chambers at three of its facilities, threatening stored blood products. The incident occurred on November 2 and affected systems used to monitor and control cold-storage chambers. According to a statement published on November 3, EFS was not directly targeted. Instead, the attackers hit its refrigeration supplier. While EFS has not named the supplier involved, European refrigeration equipment provider Coolworld Rentals confirmed in a statement that a cybersecurity incident involving remote monitoring software had affected a limited number of its refrigeration units. The company said attackers exploited a vulnerability in a third-party component that was outside its direct control. "The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld's direct control," the company said. "Only a limited number of Coolworld units were affected, and Coolworld responded promptly and took appropriate measures." Coolworld said it is working with affected customers but will not comment on individual cases. At the EFS facilities, the attack raised temperature and defrost thresholds in affected cold-storage chambers to extremely high levels. These facilities store blood products before distribution to hospitals, as well as biological samples maintained by the organization. EFS said its monitoring and alarm systems quickly detected the temperature change, allowing staff to repair impacted equipment or transfer products to other refrigeration facilities. "No health impact has been identified, and no loss of blood products has been reported," EFS said in its statement, translated from French. The organization confirmed that plasma bags intended for transfusions and plasma used to manufacture medicines were either transferred or secured, preventing damage. Blood collection and distribution operations have continued without interruption. EFS said its technical teams are working with France's national cybersecurity agency (ANSSI) and the Ministry of Health, and that it has strengthened monitoring of refrigeration equipment and temperatures. The incident follows a wave of cyberattacks targeting refrigeration systems across Europe, in which attackers remotely manipulate temperature settings or activate defrost functions that switch off cooling. In October, such attacks disrupted refrigeration at an estimated 250 to 350 French supermarkets, including Intermarché, Carrefour Market, Monoprix, Leclerc, and Super U. Hackers reportedly compromised refrigeration controllers running older Danfoss software and remotely activated automatic defrosting, forcing stores to discard fresh and frozen products. Those attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which are used to monitor and manage cooling equipment remotely. A second wave this month affected more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Some systems were shut down entirely, while others had temperature settings changed remotely; at one Swedish supermarket the system reportedly began generating heat, and another store reported temperatures changed to 50 degrees Celsius. Belgian refrigeration company Sabcobel previously said the attackers behind the November incidents exploited the same vulnerability used in October's attacks against French supermarkets. In 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451, which could allow attackers to bypass authentication and execute commands remotely on vulnerable systems. It has not been confirmed whether these vulnerabilities are being exploited in the attacks.