Cyberattack Exploits Vulnerability in French Blood Storage Systems

The incident occurred on November 2 and involved altered temperature and defrost settings at three blood‑storage facilities, France's national blood service said.

Établissement français du sang (EFS): operations and immediate response

The Établissement français du sang (EFS) confirmed on November 3 that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost thresholds in cold‑storage chambers at three of its sites. EFS said its monitoring and alarm systems "quickly detected the temperature change, allowing staff to fix impacted equipment or transfer products to other refrigeration facilities." The organization added that "No health impact has been identified, and no loss of blood products has been reported" (translated from French).

EFS specified that the affected chambers store blood products prior to distribution to hospitals as well as biological samples. Plasma bags intended for transfusions and plasma used to manufacture medicines were "either transferred or secured, preventing damage to the products," the statement said. Blood collection and distribution operations continued without interruption, according to EFS.

Coolworld Rentals: supplier statement and the role of a third‑party component

Although EFS said it was not the direct target, its refrigeration supplier was. European refrigeration equipment provider Coolworld Rentals confirmed a cybersecurity incident involving remote monitoring software had affected a limited number of its units. In its statement Coolworld said: "The vulnerability currently being reported in the media relates to a component from a third‑party supplier and was outside Coolworld's direct control."

Coolworld added that "Only a limited number of Coolworld units were affected, and Coolworld responded promptly and took appropriate measures." The company said it is working with affected customers but "will not comment on individual cases."

Refrigeration system attacks across Europe and the Danfoss CVEs

The EFS incident follows a wave of attacks across Europe in which threat actors remotely manipulated temperature settings or activated defrost functions. In October, attackers disrupted refrigeration systems at an estimated 250 to 350 French supermarkets — including Intermarché, Carrefour Market, Monoprix, Leclerc, and Super U — by reportedly compromising refrigeration controllers running older Danfoss software and remotely activating automatic defrosting functions.

Those October attacks targeted Danfoss AK‑SM/AK‑SC and Copeland/Dixell XWEB refrigeration controllers. A second wave this month hit more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. In some cases refrigeration systems were shut down entirely; in others temperature settings were changed remotely. Reported effects ranged from a system "beginning generating heat" at one Swedish store to another where temperatures were changed to 50°C (122°F).

Belgian refrigeration company Sabcobel said attackers behind the November incidents exploited the same vulnerability used in October's attacks against French supermarkets. Separately, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities in 2025 affecting Danfoss AK‑SM 8xxA controllers, tracked as CVE‑2025‑41450 and CVE‑2025‑41451. CISA described the flaws as potentially allowing attackers to bypass authentication and execute commands remotely on vulnerable systems, potentially giving them control over refrigeration equipment. It has not been confirmed whether these specific vulnerabilities are being exploited in the recent attacks.

What this means for technologists, the Ministry of Health, and hospitals

• Technologists and security teams: The incident highlights the exposure posed by remote monitoring software and third‑party components. EFS said it has "strengthened monitoring of refrigeration equipment and temperatures," and Coolworld pointed to a third‑party component outside its direct control — underscoring the need to audit dependencies and remote interfaces on critical cold‑chain devices.
• The Ministry of Health and France's national cybersecurity agency (ANSSI): EFS said its technical teams are working with ANSSI and the Ministry of Health, which places national authorities at the center of incident coordination and technical assessment for medical cold‑chain resilience.
• Hospitals and blood‑product handlers: Because EFS reported no loss of product and said transfers were used to protect plasma bags and other materials, hospital blood‑storage and transfusion services will watch temperature‑monitoring alerts and interfacility transfer plans to ensure continuity of supply during any future equipment disruptions.

This incident ties a healthcare supply chain — blood storage and distribution — to broader, repeated attacks on retail refrigeration systems across Europe. EFS's quick detection and transfer protocols prevented product loss in this case, and both a supplier and national agencies are now engaged. The record ends with a single, clear unresolved fact: investigators have not confirmed whether the Danfoss CVEs disclosed by CISA in 2025 are being used in these attacks.

Original reporting: https://www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france/