In France, on the night of November 2, 2026, hackers targeted the refrigeration systems of the state-run blood donation service, EFS. During this cyberattack on blood bank facilities, the perpetrators manipulated the controls of cooling units at three locations by accessing them through an external service provider. Instead of maintaining a temperature of minus 30 degrees, they set the systems to reach temperatures as high as 110 degrees Celsius. This threatened to destroy blood plasma intended for transfusions, as well as vital medications. However, alarm systems triggered in time to prevent major damage before the units could reach those temperatures. The incident follows a series of similar attacks on supermarkets across Europe. French security authorities are currently investigating the circumstances behind the attack.
Image: Shutterstock
Investigators seek perpetrators behind Europe-wide cyberattacks on refrigeration systems
So far, no hacker group has claimed responsibility. However, France’s cybersecurity agency, ANSSI, has been investigating targeted attacks on networked refrigeration systems since mid-October. Investigators have identified several affected control systems, including equipment from Danfoss, Copeland, and Dixell. A link between the attacks on supermarkets and the attack on the blood donation service has not yet been established.
Security experts are considering both the possibility of individual hackers and state-sponsored sabotage. British cybersecurity expert Rafe Pilling, from Sophos, believes both scenarios are plausible. Nevertheless, there is currently no concrete evidence of involvement by Russia or other states. The attackers have neither issued any known political demands nor released a public statement claiming responsibility. Consequently, it remains unclear whether their intent was to cause economic damage or to deliberately target critical infrastructure.
Cyberattack on Blood Bank Hits External Refrigeration Service Provider
The cyberattack appears to have been carried out via the remote maintenance system for the refrigeration equipment, rather than through the blood donation service’s internal computer network. On November 4, the refrigeration specialist Coolworld confirmed a security incident involving its remote monitoring software. The company pointed to a component supplied by a third party—one that fell outside its direct control. Coolworld stated that it has taken action and is supporting affected clients, though it has not disclosed the specific security vulnerability or the product involved.
This highlights a particularly problematic attack vector. Even when hospitals secure their own computer systems, external maintenance access points remain a potential gateway for intruders. In such cases, hackers do not need direct access to medical data or hospital servers; instead, they can manipulate physical infrastructure by compromising poorly secured control systems. It is precisely this link between digital remote maintenance and critical, life-sustaining equipment that makes such an attack so dangerous.
Spoiled Blood Plasma Could Jeopardize Vital Treatments
The affected cold-storage units primarily contained deep-frozen blood plasma and donor samples. Plasma provides essential clotting factors and is used, among other things, to treat severe bleeding. Furthermore, pharmaceutical companies use it to derive immunoglobulins, albumin, and other medicinal products. If temperatures rise beyond permissible limits, sensitive proteins can undergo structural changes. Consequently, blood products that have experienced a critical temperature deviation cannot be used without first undergoing a quality assessment.
A large-scale loss of stored plasma stocks would be particularly dangerous. Hospitals would be forced to rely on reserves from other locations, while the blood donation service would have to scramble to secure replacements. Significant shortages could lead to delays in medical treatment. Moreover, once deep-frozen plasma has been thawed, it cannot simply be refrozen. Replenishing stocks requires additional blood donations, processing, and quality control checks. In this specific instance, however, timely intervention prevented any reported loss of products.
Known security vulnerabilities facilitate repeated attacks on refrigeration systems
On October 12, the French cybersecurity authority issued a warning regarding compromised refrigeration systems. Affected equipment included, among others, Danfoss controllers (AK-SM and AK-SC series) as well as XWEB systems from Copeland and Dixell. According to security experts, attackers in previous incidents exploited known vulnerabilities, outdated software, and inadequately secured remote access points. Devices using factory-default passwords and maintaining a direct connection to the internet are particularly problematic.
The economic repercussions are already becoming apparent within the European retail sector. The retail group Ahold Delhaize anticipates potential revenue losses of up to 250 million euros as a result of the October attacks, which could lead to a decline in operating profit of up to 100 million euros. Numerous supermarkets were forced to discard spoiled food while technicians worked to regain control of the refrigeration systems. However, the renewed attacks in early November indicate that existing security measures are not yet sufficient in all cases.
Manufacturers and operators must secure remote access
The French agency CERT-FR recommends completely disconnecting vulnerable refrigeration control systems from the public internet. In the future, remote maintenance should only be conducted via secure connections. Furthermore, operators must replace default passwords, update software, and verify all temperature settings. Simply restarting outdated devices that lack security updates is explicitly insufficient, as attackers could immediately exploit the same vulnerabilities again.
The healthcare sector is also taking action. The international health network Health-ISAC recommends the use of additional temperature sensors, independent alarm systems, and mechanical safety cut-offs. These measures are intended to prevent dangerous temperature fluctuations, even if hackers gain control of the digital management systems. Additionally, external maintenance access should be time-limited and subject to enhanced security measures.
EU coordinates protective measures against further attacks
The European Commission, Europol, and the cybersecurity agency ENISA are currently coordinating investigations into this series of attacks. Since October 11, European authorities have repeatedly recorded instances of tampering with commercial refrigeration systems. Following another wave of attacks on November 1 and 2, they urged companies to implement immediate protective measures. However, it remains unclear how many vulnerable systems are still accessible via the internet.
France’s blood transfusion service has since disabled remote access to affected systems and stepped up its monitoring. As a result, the blood supply remained uninterrupted while staff secured or relocated at-risk stocks. Nevertheless, the incident highlights a significant reliance on external technical service providers. If their control systems are compromised, attackers could not only destroy food supplies but also jeopardize the availability of vital blood products.
Author: Blackout News
Sources: AP (03.11.26) – Coolworld (04.11.26) – Enisa (04.11.26) – The Guardian (04.11.26) – Cert (12.10.26)