What happened at France's blood service?
France's national blood service confirmed on 3 November that hackers had reached the monitoring and control systems for cold rooms at three of its sites. The incident happened overnight on 1-2 November, as a second wave of refrigeration attacks hit supermarkets across Europe.
The French Blood Establishment, known as EFS, collects, tests and distributes blood products to more than 1,900 hospitals and supports more than a million patients a year. Its cold rooms hold plasma for transfusions and for manufacturing medicines.
EFS said it was not the direct target. The entry point was a refrigeration equipment supplier, identified by BleepingComputer and Infosecurity Magazine as Coolworld, a Dutch temperature-control rental company. Coolworld said remote monitoring software was involved and blamed a vulnerability in “a component from a third-party supplier” outside its direct control.
The attackers raised temperature and defrost thresholds in the affected rooms to “very high levels”, according to EFS. Plasma is normally stored at about -30°C. Moving a setpoint that far can ruin stored products if nobody intervenes.
Staff did intervene. EFS said its alarms alerted an on-call technician, and products were moved to refrigerators that were not connected to the compromised system. EFS spokesperson Charley Dubois told Reuters that workers “moved the blood to other refrigerators that were not connected”.
The health ministry said the incident hit “cold storage room monitoring and control systems” at several regional facilities. EFS said blood supplies were unaffected. The health ministry said the situation was under control on 4 November, when remote access to the affected equipment was disabled.
EFS reported that “no health impact has been identified” and that no blood products were lost. Blood collection and distribution continued without interruption. The agency said it had alerted ANSSI, France's national cybersecurity agency, and the health ministry, and had strengthened monitoring of its cold rooms.
How did the attack work, and did the cold rooms reach 110°C?
Cold rooms depend on digital controllers that log temperatures and switch cooling or defrost cycles. Many are maintained by contractors over a network, so engineers can troubleshoot without visiting each site.
The EFS statement refers to supervision and control systems. That distinction matters. A monitoring tool shows temperatures. A control tool can change them, including the thresholds that trigger alarms and defrost cycles.
In the supermarket attacks, contractors described a specific abuse. Sabcobel said the evaporators were switched into defrost mode and left there. Defrost is a normal maintenance cycle. Holding it disables cooling and lets temperatures climb.
Security researchers had warned about this class of device before the attacks. Claroty's Team82 found multiple flaws in the web interface of the Danfoss AK-SM 800A, a controller used in supermarkets and cold-storage sites. It identified 2,765 exposed devices through Censys and showed how one flaw, CVE-2025-41451, could lead to remote code execution. Danfoss fixed the issues in new firmware.
France's CERT-FR said it knew of many compromises involving Danfoss AK-SM and AK-SC controllers, plus Copeland and Dixell xweb units. Its advice was blunt: remove internet exposure, review defrost ranges, restore access only through a VPN and update firmware.
The barrier is low once a controller is reachable. “A few commands to a temperature controller can destroy stock overnight and close stores,” Patrick Lamplmair of the security firm Tributech told the Guardian.
Several French outlets reported that the cold rooms were programmed to heat to 110°C. The figure came from Le Canard Enchaîné, which disclosed the incident on 3 November and placed affected sites in Burgundy and Franche-Comté.
That number describes a controller setting, not a measured temperature. Infosecurity Magazine noted that the reporting did not show the equipment or any samples reached 110°C. A setpoint is an instruction. The real air or product temperature depends on insulation, how long cooling fails and how quickly staff respond.
EFS did not confirm the 110°C figure in its own statement. It said thresholds had been raised to very high levels and that alarms let staff act before products were compromised. The distinction is not a technicality. It separates a changed setting from confirmed damage to medical material.
EFS president Frédéric Pacoud told BFMTV that the service “could have lost samples or bags of plasma intended to treat patients”. He said the early warning meant there was no compromise to the safety of blood products.
Several headlines described blood being boiled. Nothing published so far supports that. The accurate claim is narrower. Attackers changed settings on monitoring and control systems, and staff reversed the change in time.
It is not publicly known how the attacker reached Coolworld's remote monitoring software. Coolworld says the vulnerable component came from a third party. Investigators have not described the entry path, the credentials used or whether the tool was exposed to the internet.
Nor has anyone said which flaw, if any, was used in the supermarket attacks. The Claroty research shows what is possible on a widely deployed controller, not what happened in every case.
How does the blood attack fit Europe's wider fridge campaign?
On the night of 11-12 October, hackers forced refrigeration units at hundreds of French supermarkets into sustained defrost. Temperatures climbed towards 50°C, food spoiled and some stores reported small fires.
Estimates of the scale vary. The Guardian reported as many as 700 stores. The BBC's tally of statements from individual chains suggested about 400. BleepingComputer put the October figure at 250 to 350.
Chains including Intermarché, Netto, Coopérative U, Carrefour, Monoprix and Leclerc were affected. Two supermarkets in Alsace reported a combined €270,000 in lost goods. French prosecutors opened an investigation into what the Paris prosecutor's office called a large-scale cyber-attack.
The store counts reported at the time varied by chain. More than 100 Coopérative U stores were targeted. Intermarché and Netto counted 180 affected stores and disconnected another 100 as a precaution. Carrefour reported 80 of its 6,000 outlets, and Monoprix said 5% of its 400-plus stores were hit.
A second wave began on 2 November. That evening the BBC counted seven countries: Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. Around 40 Delhaize stores in Belgium and Luxembourg were affected.
Retailers described the same pattern. Sabcobel, which runs Delhaize's refrigeration systems, said evaporators were switched into defrost mode and held there. Temperatures reportedly reached 50°C in some shops.
The campaign widened again on 3 November. Italy's government held emergency talks after about 20 stores were hit. Germany reported four stores, Romania six and the UK a couple of instances.
By then Euronews counted at least 11 affected countries. The EU's food commissioner, Christophe Hansen, called the attacks “a deliberate attempt to disrupt our food supply chain”.
The EFS incident is not publicly confirmed as part of the same campaign. The timing and the reliance on remote refrigeration monitoring are similar. No investigator has said the same actor or the same flaw was used.
Who is behind the attacks?
No group has credibly claimed responsibility. Two hacktivist groups, NoName057(16) and Z-Pentest Alliance, posted that they had hacked Danfoss, the Danish controls maker whose equipment appeared in the French supermarket attacks.
Analysts are sceptical. Sekoia, a French threat-intelligence firm, told the BBC it had “no technical evidence indicating the involvement of Russian-speaking groups”. It also noted that NoName057 is known mainly for denial-of-service attacks and has made false claims before.
Sekoia's report kept several possibilities open. It said the activity was consistent with Russian hacktivists or the Russian state. It also pointed to Iranian-aligned actors, who have targeted exposed industrial controls in the past.
That is not hypothetical. Sekoia said about 40 Israeli supermarkets running Danfoss controllers were compromised in 2022. The same equipment family has now appeared in Europe.
Other officials doubt the operation was professional. Dan Cimpean, who leads Romania's national cyber security directorate, called it “semi-amateurish”. He said his agency did not suspect a state actor “under any circumstances”.
Honeypots have produced the most concrete clues. Three security firms set up fake refrigeration systems. Lupovis, based in Scotland, saw scanning against its decoys for 10 days before the second wave, and only in Europe.
Previdian's Ryan Dewhurst said the simultaneous timing pointed to planning and coordination. The firms have not ruled out a lone operator, a prankster or copycats repeating a technique that is already public. Sekoia said the three waves could have involved different groups.
The UK's NCSC chief executive, Richard Horne, said it was “too early to say” who was responsible. Sophos's Rafe Pilling listed two plausible scenarios: a state signalling its capability, or a lone-wolf hacker.
Motive is equally unclear. There have been no ransom demands. SentinelOne's Tom Hegel told the Guardian that the absence of extortion pointed towards sabotage rather than profit.
Why are hospital cold rooms exposed?
Cold rooms are networked because remote monitoring saves money. Contractors can spot a failing compressor or a door left open without sending a van.
That convenience creates a large attack surface. Forescout research published in October found nearly 13,000 refrigeration control services openly reachable online in 99 countries.
Many controllers are old. Sweden's Coop said the equipment involved in its seven affected stores had been connected over old 4G mobile networks. Danfoss said the French supermarket units were older models that could not be updated to fix a risk it had identified.
Patching is not always enough. Sabcobel's Stephan Moelans said some units needed physical modifications, not just software updates. That work takes time and money.
Supplier access adds another layer. Hospitals and retailers can rent refrigeration equipment and rely on the vendor for maintenance. An attacker who compromises the vendor's remote tool can reach many customers at once.
Coolworld said the vulnerable component came from another supplier. That kind of chain is hard to audit and harder to patch quickly, because no single company controls every layer.
The pattern is not confined to Europe. In late August, freezers at commissaries on at least six US military bases were forced into defrost mode. The Pentagon is investigating whether those incidents were linked.
There is no public evidence that the EFS controllers were directly exposed to the internet or that they shared the supermarket flaw. The common factor is remote control of cooling equipment.
What is Europe doing about it?
The European Commission is treating the incidents as a coordinated problem. A spokesperson, Thomas Regnier, said: “These are not isolated incidents and of course we have to be collectively resilient and prepared for such cyber incidents.”
National responses vary. Italy convened intelligence and cyber officials, and its national cybersecurity agency issued technical advice to retailers. Belgium's federal prosecutor opened an investigation. France's Paris prosecutor is examining the October supermarket attacks, and ANSSI is involved in the blood service case.
The Commission said its agencies were holding urgent discussions with national authorities to shape a collective response. That work is still at the talking stage. No new EU-wide rule for refrigeration controllers has been announced.
The UK's NCSC said it worked through the night to alert organisations. Horne said the incidents exposed underinvestment in the technology that society depends on.
Existing EU law already covers much of this ground. The NIS2 directive, in force since January 2023, requires member states to supervise essential sectors including health. Countries had until 17 October 2024 to transpose it.
The Cyber Resilience Act goes further for products. It entered into force on 10 December 2024. Reporting duties began on 11 September 2026, and most obligations apply from 11 December 2027.
Those dates leave a gap. Equipment installed years ago, and contracts signed before the rules bite, will not fix themselves. Regulators can set standards, but operators still have to find and isolate legacy devices.
The harder question is scale. A hospital can move plasma to another room. A supermarket chain with hundreds of sites cannot move stock as easily, and a blood service cannot reroute patient demand.
Watch three things. First, whether attacks spread into new sectors such as water or transport. Second, whether investigators attribute this campaign. Third, how Brussels turns the incidents into guidance under NIS2 and the Cyber Resilience Act.
For now, the confirmed damage is food and disruption, not blood. The confirmed lesson is that internet-connected cooling equipment sits inside critical infrastructure, whether the owner treats it that way or not.
What should hospitals and food operators do next?
The first task is visibility. Many organisations do not know which cooling units are online, who supplied them or which contractor can reach them. An asset list is the starting point.
- •Inventory every refrigeration controller, including rented units and contractor-owned equipment.
- •Remove direct internet exposure and route remote access through a VPN or an allowlisted gateway with multi-factor authentication.
- •Segment cooling systems from office and payment networks so one compromised PC cannot reach every site.
- •Keep an independent temperature alarm that does not depend on the same controller.
- •Test manual overrides and rehearse moving stock to an unaffected cold room, as EFS staff did.
- •Log contractor access and write security requirements into maintenance and rental contracts.
- •Check insurance conditions before disabling a contractor's data feed, as CERT-FR warns cover may depend on it.
- •Confirm another cold room has capacity and staff are trained to move stock overnight.
- •Replace end-of-life controllers or isolate them. A patch that cannot be installed is not a fix.