Hackers Reprogrammed France's Blood Plasma Freezers From −30°C to 110°C Through a Refrigeration Contractor
Attackers abused a contractor's access to change freezer setpoints at France's national blood service EFS; a night-shift technician caught it before any blood products were lost.
What Happened
Attackers reached the cold-storage equipment of France's national blood service, the Établissement Français du Sang (EFS), overnight between 1 and 2 November 2026 and reprogrammed freezers that hold blood products. The intrusion did not go through the EFS network itself. It went through Coolworld, a contractor that supplies and maintains temperature-controlled equipment for the blood service, including refrigerated units used in medical settings.
According to the details made public so far, freezer setpoints that normally sit around −30°C were changed to roughly 110°C. Facilities in the Bourgogne-Franche-Comté region were among those affected. An on-call technician noticed temperatures climbing during the night and staff intervened before the situation turned into a loss.
EFS says no blood products were lost and no health consequences have been identified. The Health Ministry said the abnormal temperatures were detected in time and that the incident caused no operational consequences. No ransom demand has been reported and no files were encrypted. This was sabotage of physical equipment, not an extortion play.
What Was at Risk
EFS first described the affected stock as donor samples kept for blood-safety monitoring, the reference tubes used to investigate a transfusion reaction after the fact. It later clarified that frozen plasma intended for patient transfusion was also involved.
That correction matters. Fresh frozen plasma has to stay at −25°C or colder. A freezer told to heat up does not need to reach anything close to 110°C to ruin it. A few degrees of drift for long enough is enough to force a batch to be discarded, and plasma is not something a blood service can quickly replace.
Setpoint Versus Reality
The 110°C figure is the temperature requested through the control system, not a measured temperature inside the freezers. Medical freezers have no heating element capable of that. What a hostile setpoint does is stop the cooling and let the contents warm toward room temperature, or trigger defrost behaviour, until someone notices.
Several things have not been disclosed:
- how many units and sites were touched
- how long the setpoints stayed changed
- what temperatures the stored products actually reached
- which controller models were involved and how the attackers got in
No stolen account, exploited vulnerability or donor-data theft has been confirmed.
Part of a Wider Wave
The blood-service incident lands in the middle of a run of attacks on connected refrigeration across Europe. In October, hundreds of French supermarkets had freezer and cold-room controllers manipulated overnight, with temperatures forced up to around 50°C. Some of those attacks abused automatic defrost functions to keep units heating for hours, causing food losses and reported fires. Stores in the UK, Italy, Germany, Sweden, Belgium, Luxembourg, Ireland, Estonia, Finland and the Netherlands have reported similar incidents, with losses put in the millions of euros.
The EU Agriculture Commissioner called the attacks a deliberate attempt to disrupt the food supply chain and said their repeated occurrence is deeply concerning.
In mid-October, CERT-FR issued an alert confirming numerous compromises of internet-exposed refrigeration management systems, naming Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems. Researchers point out that these controllers are often left reachable from the internet with default passwords or weak maintenance bypasses.
There is no public evidence that the same products, or the same attackers, were behind the EFS intrusion. Nobody has been identified. Suspects floated so far range from Russian-linked groups and Iranian hacktivists to state actors and pranksters.
The Contractor Is the Attack Surface
The lesson from the blood-service case is the same one the supermarket wave keeps teaching. The hospital or blood bank does not need to be breached for its cold chain to be sabotaged. Refrigeration vendors run remote maintenance portals so engineers can adjust setpoints, clear alarms and schedule defrosts without driving to site. Whoever controls that portal controls the freezers.
That access is often invisible to the healthcare organisation's security team. It sits outside the corporate network, is managed under a facilities contract rather than an IT one, and is rarely covered by the same identity, logging and patching rules as clinical systems.
What To Do Now
For hospitals, blood services, laboratories and pharmacies that rely on connected cold storage:
- Inventory remote access. List every vendor that can reach refrigeration, building-management or monitoring systems remotely, and how they do it.
- Take controllers off the internet. Management interfaces should never be publicly reachable. Remote access should go through a VPN or protected gateway with multi-factor authentication.
- Change default credentials and update firmware on controllers and gateways, and turn on the security settings the vendor provides.
- Review configurations, not just alarms. Check setpoints, alarm thresholds and defrost schedules against a known-good baseline, and get alerts when they change.
- Keep independent temperature monitoring. A logger or alarm that does not depend on the same controller, or the same vendor portal, is what lets a night-shift technician catch a sabotaged freezer in time.
- Write it into the contract. Require maintenance vendors to report incidents, log remote sessions and meet minimum security controls.
Why It Matters
This incident ended well because a person was watching the temperatures at 3 a.m. The attack itself needed no malware on a hospital PC, no ransom note and no data theft, only a reachable control interface at a supplier. As attacks on refrigeration controllers spread from supermarkets to medical stock, cold-chain equipment has to be treated as critical infrastructure, with the vendor access behind it secured accordingly.
