French blood service hit by refrigeration cyberattack
Temperature controls at three French blood-service sites were altered amid attacks on European retailers. No blood products were lost, officials said.
News analysis | Reporting reviewed: 5 November 2026
A cyberattack affecting refrigeration controls at three sites operated by France’s national blood service has brought the security of connected cold storage into sharper focus, following disruptions at supermarkets across Europe.
The Établissement Français du Sang (EFS) said temperature and defrosting thresholds at affected cold rooms had been raised to unusually high levels. Monitoring systems detected the anomalies, allowing staff to secure equipment or move stored products. No health consequences or losses of blood products were reported, and collection and distribution continued, according to reporting by DW and AP.
The incident occurred overnight into 2 November. EFS said it was affected through a refrigeration equipment provider rather than being directly targeted, The Record reported, citing the organisation’s statement and a spokesperson.
What happened at the French blood-service sites?
The disruption involved systems used to supervise and control cold rooms. Products stored in affected facilities included plasma intended for transfusions or medicine manufacturing, according to Le Monde’s reporting.
France’s health ministry said remote access to affected equipment had been disabled and technical investigations were continuing. The scope of affected equipment and conditions for returning systems to service remained under examination, Reuters reported on 4 November.
Some coverage cited a reported setting of 110°C (230°F), attributed to French weekly Le Canard Enchaîné. That figure should not be read as proof that stored plasma reached that temperature. Reporting describes altered control settings; EFS said its response prevented products from being compromised. DW distinguishes the reported programming from the outcome.
Why connected refrigeration systems are vulnerable
Commercial refrigeration often relies on supervisory software that lets technicians monitor equipment, review alarms and change operating settings remotely. Those capabilities support maintenance across multiple locations, but they also give unauthorised users a way to interfere with physical operations if access is compromised.
Claroty’s Team82 research documented vulnerabilities in the web management interface of Danfoss AK-SM 800A controllers. The researchers disclosed the issues to Danfoss, which addressed them through firmware updates. The research demonstrates potential attack paths; it does not establish which vulnerability, if any, was used in the blood-service incident.
An important feature of refrigeration attacks is that harmful changes can use ordinary management functions. Adjusting a defrost schedule or temperature setting can disrupt storage without requiring malware designed to destroy a device, Forescout’s Vedere Labs explains.
A European disruption with wider relevance
The French blood-service incident followed attacks on French supermarkets in October and further refrigeration disruptions across Europe in early November. Censys documented reports involving stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden in its 2 November assessment.
For background on the earlier exposure findings, see IPSIP Vietnam’s coverage of internet-exposed Danfoss refrigeration systems. Its scan figures describe an earlier assessment and should not be combined with later surveys as a single total.
The similarities do not establish that one group carried out every incident. Censys said it was unconfirmed whether the same actor was responsible for the October and November attacks. Le Monde likewise reported that links between the blood-service incident and the supermarket attacks had not been established.
The potential exposure extends beyond the affected retailers. In research published on 22 October, Forescout identified 12,976 internet-exposed service observations across 6,017 distinct public IP addresses in 99 countries and territories. The survey covered multiple product families, some also used for building automation and HVAC.
Those figures describe discoverable services, not 12,976 hacked refrigerators or confirmed victims. One address can expose several services, and one management interface can oversee multiple downstream systems. Bitsight’s separate analysis also cautioned that raw scan results can be inflated by decoy systems known as honeypots. Exposure estimates therefore need to be read with their methodology and measurement dates.
What authorities recommend
France’s CERT-FR alert, first published on 12 October and updated on 16 October, identified compromises involving Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB systems. This broader alert should not be treated as identification of the equipment used at EFS.
CERT-FR advises operators to remove management interfaces from direct public internet access, verify configurations and restore remote access through a secure VPN or protected network. It also calls for firmware updates and changes to default passwords, following manufacturer guidance.
The agency warns that resetting an unsupported, vulnerable device is insufficient if it is then left exposed. Forescout additionally recommends named contractor accounts, multifactor authentication, restricted permissions and records that connect remote sessions with configuration changes.
For further reading on administrative access controls, IPSIP Vietnam’s guide to privileged access management (PAM) explains how account permissions and session oversight fit together.
The lesson for international cold-chain operators
The French case shows the value of monitoring and a response that can protect stored products when control systems behave unexpectedly. It also highlights a practical question for organisations relying on refrigeration contractors: who is accountable for remote access, software maintenance and alarms?
Clear ownership matters for routine maintenance too. IPSIP Vietnam’s guide to patch-management responsibilities and performance metrics provides background on allocating update and exception-management tasks in IT support. Refrigeration controllers require an equipment-specific process agreed with the vendor and operations team.
For international readers, the significance reaches beyond supermarket food losses. Connected cooling supports healthcare, agriculture and other temperature-sensitive operations. Viewed through the broader lens of industrial cybersecurity and OT infrastructure protection, the operational lesson is to treat access to refrigeration controls as access to the service those controls sustain.
-------
Sources
