A cyberattack on refrigeration equipment used by France’s national blood service threatened temperature-sensitive medical supplies at three facilities. Staff detected the unauthorized changes before any blood products were damaged, allowing the organization to maintain normal collection and distribution operations.
The incident occurred on November 2, 2026, and affected cold-storage systems operated by the French Blood Establishment (EFS), which manages blood collection, processing, and distribution throughout France. According to the organization, attackers manipulated temperature controls and defrost settings, raising them to dangerously high levels.
The affected facilities stored plasma intended for transfusions and for the manufacture of medicines, along with biological samples. Such materials require controlled storage conditions, making unauthorized changes to refrigeration equipment a potential threat to healthcare operations.
EFS said its monitoring and alarm systems identified the abnormal settings quickly. Technical personnel responded by correcting the affected equipment and transferring or securing medical products in unaffected storage facilities.
The organization confirmed that no blood products or samples were lost and that no health consequences had been identified. Blood collection and distribution continued without interruption.
Importantly, the attackers did not directly compromise EFS’s own network. The incident instead involved equipment supplied by an external refrigeration provider.
Coolworld Rentals, a European refrigeration equipment company, acknowledged a cybersecurity incident involving remote monitoring software. The company said attackers exploited a vulnerability in a component supplied by a third party, which was outside its direct control. Only a limited number of its refrigeration units were affected, according to Coolworld.
The incident occurred during a broader wave of attacks against remotely managed refrigeration systems across Europe. In October, hundreds of French supermarkets experienced similar disruptions after attackers manipulated cooling equipment, forcing stores to discard refrigerated and frozen products.
Another wave followed in early November, affecting retailers in countries including Belgium, Sweden, Ireland, Luxembourg, the Netherlands, and Estonia. Some businesses reported refrigeration temperatures rising to 50°C, while others experienced unauthorized activation of defrost functions.
Security concerns have focused partly on internet-accessible industrial controllers. Previously disclosed vulnerabilities in certain Danfoss refrigeration systems can permit unauthorized access or remote command execution. However, investigators have not confirmed whether those vulnerabilities were involved in the attack on EFS.
France’s national cybersecurity agency, ANSSI, is investigating the incident alongside the Ministry of Health. EFS has also strengthened monitoring of its refrigeration equipment, while remote access to affected units has been disabled.
The identity and motives of the attackers remain unknown. Authorities have not established whether the incident involving the blood service and the attacks against European supermarkets were carried out by the same perpetrators.