EFS: three blood stores pushed hot, none lost

France’s national blood service says a cyberattack on November 2, 2026 changed the cold at three of its sites. The Établissement français du sang (EFS) collects, processes, and distributes blood for the country. The chambers involved hold products waiting for hospitals, and biological samples the service keeps. Temperature and defrost thresholds on those rooms were driven to extremes. On November 3, EFS said its alarms fired, staff corrected the equipment or moved the stock, patients were unaffected, and the blood products themselves were not lost.

EFS says the attackers aimed at the company that refrigerates the rooms. European rental firm Coolworld has confirmed a security incident in its remote monitoring software, on a limited number of units. Coolworld attributes the weakness to a component from a third party, outside its own code, and says it is working with the customers involved. It has declined to discuss individual sites. EFS has not publicly named the supplier. The two statements sit on the same incident: a monitoring path the blood service does not own, with write access to the cold.

Plasma for transfusion, and plasma used to manufacture medicines, was moved or secured before it spoiled. Collection and distribution continued. EFS says its technical teams are working with France’s cybersecurity agency, ANSSI, and the health ministry, and that watching the equipment and the temperatures has been tightened.

The cold chain was already under attack

Through October, remote intrusion into refrigeration controllers disrupted an estimated 250 to 350 French supermarkets, a list that includes Intermarché, Carrefour Market, Monoprix, Leclerc, and Super U. Public reporting on those cases names Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB units. Defrost was turned on from outside the store. Fresh and frozen food was thrown out.

A further wave this month has reached more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Some plants were shut off. Others had their setpoints rewritten. One Swedish supermarket’s system began producing heat. Another site was taken to 50°C. Belgian firm Sabcobel has said the November store attacks used the same vulnerability as the October wave.

In 2025, CISA published two flaws in Danfoss AK-SM 8xxA controllers, CVE-2025-41450 and CVE-2025-41451. A remote party who reaches a vulnerable controller can get past authentication and issue commands. Nobody has confirmed that those two identifiers are the ones behind the European incidents. A blood service, a hospital, or a grocer running that hardware family still belongs on the fixed builds. The command details stay in the CISA advisory.

Coolworld describes a third-party component inside monitoring software. The supermarket cases name a specific set of controllers. Keep them as two patch lines. They share one failure: a remote party can change a setpoint.

What a cold room needs this week

List every chamber whose temperature can be changed by someone who is not standing in front of it. Include rented units, vendor portals, and controllers that phone home for monitoring. EFS lost nothing because a local alarm still worked after the remote setting was wrong. Copy that. Alarm on the setpoint and the defrost schedule, as well as on the temperature that shows up an hour later. The page has to reach a person who can move blood. That is the difference between a scare and a discard.

Ask the refrigeration vendor, in writing, which software and which third-party component sit on your units, whether those units fall inside the “limited number,” and what changed on November 2. If the honest answer is a portal nobody in clinical engineering has reviewed, take remote write access off the open internet. Vendor maintenance can use a brokered session. A controller that will accept a new defrost threshold from anywhere is part of the clinical system, whoever bought it.

Write the transfer plan before the next alarm: which backup chamber is qualified, who is on call, how long each product can sit, and who tells the hospital if a delivery slips. EFS moved plasma and kept drawing blood. That sequence has to exist when the page arrives, because the page is when the clock starts.

Apply the known fixes on Danfoss AK-SM 8xxA, including CVE-2025-41450 and CVE-2025-41451, and confirm versions on Copeland/Dixell XWEB and on older Danfoss builds named in the supermarket incidents. Separate those networks from corporate IT and from guest Wi-Fi. Log every setpoint change with a user and a time, and read that log the way you read a production change.

EFS got the ending a blood service wants: three sites disturbed, zero bags lost, service still open. Detection and a place to move the stock did that. The supplier path that moved the thresholds is the item still open.

This briefing relies on public reporting by BleepingComputer and on statements from the French Blood Establishment and Coolworld. It does not include exploit procedures.