Blood products remained safe after staff intervened at three French blood-service sites, while attacks on supermarket cooling systems forced retailers across Europe to discard food.
A cyberattack affecting refrigeration controls at three facilities operated by France’s national blood service has brought renewed attention to the physical consequences of compromised connected equipment, following a series of disruptions to supermarket refrigerators and freezers across Europe.
The incident occurred overnight between November 1 and 2, 2026, affecting systems that monitor and control cold-storage rooms used by the French Blood Establishment, known as EFS. Authorities said staff responded to alerts and secured the stored products before their integrity was compromised. Blood supplies were unaffected.
EFS said the intrusion affected a refrigeration-equipment provider rather than directly targeting the blood service’s own systems. Temperature and defrost settings at the affected facilities were raised to unusually high levels. Monitoring systems detected the changes, allowing personnel to intervene and transfer products to alternative refrigeration facilities.
The stored materials included plasma intended for transfusions and plasma used to manufacture medicines. EFS reported no identified health consequences or loss of blood products, and said blood collection and distribution continued without interruption. Its technical teams have been working with France’s national cybersecurity agency, ANSSI, and the health ministry, while increasing surveillance of refrigeration equipment and temperatures.
By November 4, the health ministry said the situation was under control and remote access to the affected refrigeration systems had been disabled. Investigators were examining the method of intrusion, the equipment involved and the conditions required for systems to return safely to service.
Supplier acknowledges remote-monitoring incident
Refrigeration provider Coolworld Rentals acknowledged on November 4 that a cybersecurity incident involving remote-monitoring software had affected a limited number of its units.
The company attributed the reported vulnerability to a component supplied by a third party, saying it was outside Coolworld’s direct control. It said it had taken appropriate measures and was supporting affected customers, but declined to discuss individual cases. Its public statement did not explicitly identify EFS as a customer affected by the incident.
Reports of exceptionally high temperature settings require careful distinction from actual storage conditions. The available accounts describe attackers changing control parameters; EFS’s statement that products were protected does not support a claim that stored plasma reached those programmed temperatures.
Retailers face food losses across multiple countries
The blood-service incident coincided with refrigeration disruptions affecting European food retailers. AFP reported on November 3 that businesses in at least nine countries Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden had reported refrigeration problems, with some forced to discard food after temperatures rose overnight.
In Belgium, Carrefour said 15 of its more than 700 stores were affected, while Delhaize reported problems at several dozen outlets, predominantly in Belgium and a smaller number in Luxembourg.
These incidents followed October attacks on hundreds of French supermarkets. Affected chains included Carrefour, Monoprix, Les Mousquetaires, E. Leclerc and Coopérative U. Attackers manipulated cooling controls or activated defrost functions, interrupting refrigeration and forcing the disposal of perishable products. However, investigators have not established a connection between the supermarket attacks and the EFS supplier incident.
Authorities warn against exposed refrigeration controls
France’s CERT-FR has identified compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland XWEB and Dixell XWEB systems.
Its guidance calls for operators to remove management interfaces from direct internet exposure, inspect configurations including defrost schedules and restore remote access through a secure VPN or protected network. It also recommends firmware updates and replacement of default passwords. The agency warns that a factory reset alone will not adequately protect unsupported equipment that remains exposed and vulnerable.
Internet-exposure measurements suggest operators have begun responding. Cybersecurity company Censys reported that publicly reachable hosts across two relevant controller families fell 53%, from 6,695 to 3,124, between October 9 and November 5. These figures measure exposed systems, rather than confirmed victims, and do not establish why individual devices went offline.
The perpetrators and motives remain unidentified, and responsibility for the separate incidents has not been conclusively linked. For healthcare providers and retailers, the immediate concern is clear: unauthorised changes to refrigeration controls can threaten essential supplies. At EFS, functioning alarms, available staff and alternative storage prevented that threat from becoming a loss of blood products.
