Overnight between 1–2 November 2026, hackers remotely altered temperature setpoints on refrigeration equipment used to store blood plasma for the French Blood Establishment (Etablissement français du sang, EFS) by compromising its external cooling services supplier, Coolworld. According to Cyberattaque, citing French newspaper Le Canard enchaîné, facilities in the Bourgogne-Franche-Comté region were affected. Temperature setpoints on devices that should maintain roughly −30°C were reportedly changed up to 110°C. France’s Health Ministry stated that staff detected abnormal temperatures in time and that the incident had no operational consequences. An on‑call Coolworld technician noticed temperatures rising during the night and mobilized response teams before the disruption impacted transfusion services. Initial reporting focused on donor samples retained for blood safety monitoring, but EFS later confirmed to Le Canard enchaîné that frozen plasma intended for transfusions was also involved. However, the number of affected units, the exact duration of the disruption, and the actual internal product temperatures reached have not been disclosed, and available reports do not confirm product destruction, transfusion disruption, or patient harm. No public technical findings identify the attackers, a specific vulnerability, or how they gained access to Coolworld’s systems; claims that a particular Danfoss controller flaw was responsible are explicitly described as speculative by Cybersecurity News. The article situates the incident in a broader pattern of attacks on refrigeration control systems, referencing earlier attacks on supermarket refrigeration systems where attackers forced continuous defrost cycles. It notes an October 12 CERT‑FR alert describing multiple compromises of Danfoss AK‑SM and AK‑SC controllers, as well as Copeland and Dixell XWEB systems, and warning operators not to expose management interfaces directly to the internet. Cybersecurity News previously documented numerous internet‑facing Danfoss controllers via search engines but stressed that visibility alone does not prove vulnerability or compromise, and no evidence connects those exposed systems to the EFS incident. CERT‑FR’s mitigation guidance includes removing public internet access to such controllers, reviewing configurations (including defrost schedules), restoring remote access only via VPN or protected networks, applying firmware updates to supported devices, changing default passwords, and enabling all available security settings. The incident underscores that cyber compromises of suppliers can endanger physical safety by impacting medical cold chains. Independent temperature monitoring and rapid staff response are credited as key safeguards in this case, and there is no indication of donor data theft.

Overnight between 1–2 November 2026, hackers remotely altered temperature setpoints on refrigeration equipment used to store blood plasma for the French Blood Establishment (Etablissement français du sang, EFS) by compromising its external cooling services supplier, Coolworld. According to Cyberattaque, citing French newspaper Le Canard enchaîné, facilities in the Bourgogne-Franche-Comté region were affected. Temperature setpoints on devices that should maintain roughly −30°C were reportedly changed up to 110°C. France’s Health Ministry stated that staff detected abnormal temperatures in time and that the incident had no operational consequences. An on‑call Coolworld technician noticed temperatures rising during the night and mobilized response teams before the disruption impacted transfusion services. Initial reporting focused on donor samples retained for blood safety monitoring, but EFS later confirmed to Le Canard enchaîné that frozen plasma intended for transfusions was also involved. However, the number of affected units, the exact duration of the disruption, and the actual internal product temperatures reached have not been disclosed, and available reports do not confirm product destruction, transfusion disruption, or patient harm. No public technical findings identify the attackers, a specific vulnerability, or how they gained access to Coolworld’s systems; claims that a particular Danfoss controller flaw was responsible are explicitly described as speculative by Cybersecurity News. The article situates the incident in a broader pattern of attacks on refrigeration control systems, referencing earlier attacks on supermarket refrigeration systems where attackers forced continuous defrost cycles. It notes an October 12 CERT‑FR alert describing multiple compromises of Danfoss AK‑SM and AK‑SC controllers, as well as Copeland and Dixell XWEB systems, and warning operators not to expose management interfaces directly to the internet. Cybersecurity News previously documented numerous internet‑facing Danfoss controllers via search engines but stressed that visibility alone does not prove vulnerability or compromise, and no evidence connects those exposed systems to the EFS incident. CERT‑FR’s mitigation guidance includes removing public internet access to such controllers, reviewing configurations (including defrost schedules), restoring remote access only via VPN or protected networks, applying firmware updates to supported devices, changing default passwords, and enabling all available security settings. The incident underscores that cyber compromises of suppliers can endanger physical safety by impacting medical cold chains. Independent temperature monitoring and rapid staff response are credited as key safeguards in this case, and there is no indication of donor data theft.