Healthcare Cold Storage Attack: Hackers Changed Freezer Settings at the French Blood Service, What Is Confirmed and What to Check

A cyberattack on a refrigeration contractor altered the settings of cold rooms at three sites of France's national blood service, the Établissement français du sang (EFS), on Monday, November 2, 2026. EFS says no blood products were lost, but any business that relies on freezers or cold rooms managed over the internet should treat this as a warning, because the target was the equipment itself, not the office computers.

The attack came three weeks after France's national cyber response team, CERT-FR, warned of numerous compromises of refrigeration remote controllers. Whether the two are connected has not been publicly established.

What happened at the French blood service

EFS issued a statement on Tuesday, November 3. We could not retrieve the original text from the EFS press site, so its wording here comes from AP and franceinfo, which quote it.

EFS said a refrigeration supplier was the victim of a cybersecurity incident that disrupted the supervision systems for cold rooms at three of its sites. Temperature and defrost thresholds were raised to extremely high levels. AP reports the rooms held plasma for transfusion and plasma used to make medicines, and that EFS said the products were moved or secured.

What is confirmed and what is only claimed

Stated by EFS:

• Cold room supervision at three sites was affected through a supplier.
• No health consequences have been identified and no blood products were lost.
• Monitoring of its equipment and temperatures has been strengthened.

Stated by French authorities: the health minister's office said technical investigations continue and promised a further update. We found no such update as of November 8. AP reports that the national cybersecurity agency and the Health Ministry are investigating.

Reported, but not confirmed by EFS:

• The French newspaper Le Canard Enchaîné named the contractor as Coolworld. Coolworld said it is aware of an incident, that the vulnerability relates to a third-party component outside its direct control, and that a limited number of units were affected. Franceinfo notes it did not explicitly name EFS.
• Le Canard Enchaîné reported that settings normally near minus 30 C were changed to as high as 110 C. Euronews reports EFS said that temperature was never reached.

Not known: who did this, why, which vulnerability or third-party component was used, which brand of controller was involved, and how many units were touched.

Some headlines imply blood bank operations were disrupted. AP reports that collection and distribution continued.

CERT-FR refrigeration controller alert: which equipment is affected

CERT-FR alert CERTFR-2026-ALE-012 was published on October 12, 2026. It was updated on October 13 to add other targeted equipment, and again on October 16 to update the recommendations. It covers:

• Danfoss AK-SM series
• Danfoss AK-SC series
• Dixell xweb
• Copeland xweb

CERT-FR says it knows of numerous compromises, that exposing a management interface to the internet goes against good practice, and that attack campaigns are probably still ongoing. The alert does not mention EFS. L'Usine Digitale states that no link between those attacks and the EFS incident has been publicly established.

AP separately reports that hundreds of supermarkets and independent stores in France, Belgium and the Netherlands had fridges and freezers targeted in mid-October.

What Health-ISAC told healthcare organizations

Health-ISAC, an intelligence-sharing group for the health sector, issued a bulletin dated November 4, shared by the American Hospital Association. It calls the event an alleged attack, notes that no government press release had verified the reports when it was written, and places it within a wider wave of attacks on operational technology, particularly refrigeration. Its recommendations are in the checklist below.

Why a cold storage attack matters for a business network

Operational technology means the systems that run physical things: chillers, freezers, gas lines, building controls. These attacks do not need to steal a single file. Change a setpoint or a defrost schedule and the damage lands on the stock itself, which can happen with no alarm in the tools watching your office computers.

That applies well beyond hospitals: clinics, labs, pharmacies, food distributors and restaurant groups all keep value in a cold room. Three questions decide your exposure:

• Is the controller reachable from the internet?
• Who at your contractor can log in to it, and from where?
• Would anyone find out if a setting changed at 2 a.m.?

Refrigeration controllers often sit outside anyone's patching routine, which is the gap we describe in who is patching the software that runs your business. A device that still runs is not a device that is safe, as we covered in updated is not the same as patched. CERT-FR warns that keeping an end-of-life device without security patches on the internet carries a very high risk of compromise.

How to secure refrigeration controllers: what to do this week

If you think a controller was already compromised

CERT-FR's steps are: remove internet exposure (after checking insurance terms), restart the Danfoss equipment or factory-reset it if a restart does not work, restore access only through a secure VPN or protected network, reconfigure the unit before returning it to service, then apply vendor practices. CERT-FR is explicit that a factory reset alone is not enough: it clears existing persistence, but the device stays vulnerable and will likely be compromised again.

Cold storage cyberattack questions people are asking

Was any blood lost in the French attack?

EFS says no blood products were lost and no health consequences have been identified.

Did hackers really set freezers to 110 degrees?

That figure comes from Le Canard Enchaîné. EFS says only that thresholds were raised to very high levels, and Euronews reports EFS said 110 C was never reached.

Which refrigeration controllers are being attacked?

CERT-FR names the Danfoss AK-SM and AK-SC series, Dixell xweb and Copeland xweb. Which product was involved at EFS is not public.

Is the blood bank attack linked to the supermarket freezer hacks?

No link has been publicly established. Health-ISAC places it in the same wider wave of attacks on refrigeration, but that is context, not proof.

Who was behind the attack?

Not known. The sources we reviewed do not identify anyone.

Is there a patch for this?

CERT-FR names no specific vulnerability. It advises firmware updates, removing internet exposure, and treating end-of-life devices as very high risk.

Does this affect businesses in the United States?

The incidents described in these sources were in Europe. If you run internet-reachable refrigeration controllers anywhere, the same checks apply.

The bigger lesson

EFS's deputy director, quoted by RTL via L'Usine Digitale, said independent temperature control and supervision devices helped detect the anomalies and unplug equipment in time. Whoever manages your cold room should not be the only one able to tell you it is still cold. Any equipment that keeps your business running deserves the same inventory, access control and monitoring as your servers.

Want someone to find and lock down the equipment on your network? See security hardening or get a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: CERT-FR alert CERTFR-2026-ALE-012; Health-ISAC bulletin via AHA; AP via News4Jax; franceinfo; Euronews; L'Usine Digitale.