Xabar qilinishicha, xakerlar Fransiyaning Établissement Français du Sang (EFS) uchun xizmat ko'rsatuvchi Coolworld kompaniyasi tomonidan ishlatiladigan sovutish uskunasini nishonga olgan va tibbiy foydalanish uchun mo'ljallangan qon mahsulotlarining xavfsizligini buzgan.
Ushbu hujum 2026-yil 1-noyabrdan 2-noyabrga o'tar kechasi aniqlangan va muzlatgich sozlamalarini taxminan -30°C dan 110°C ga o'zgartirgan. Xabarlarga ko'ra, Fransiya Sog'liqni saqlash vazirligi texniklar muhim operatsion uzilishlarning oldini olish uchun o'z vaqtida aralashganini aytgan.
Hodisa asosan Bourgogne-Franche-Comté hududidagi muassasalarga ta'sir qilgan. Le Canard enchaîné 3-noyabrda hujum haqida xabar bergan, shundan so'ng navbatchi texnik haroratning g'ayritabiiy oshishini sezgan.
Dastlab EFS ta'sirlangan materiallarni qon quyish monitoringi uchun ishlatiladigan donor namunalari deb ta'riflagan, ammo keyinchalik bemorlarga quyish uchun mo'ljallangan muzlatilgan plazma ham jalb qilinganini aniqlashtirgan.
Muhim texnik farq sozlama nuqtasiga (setpoint) tegishli: bu nazoratchi ko'rsatmasi bo'lib, muzlatgich ichidagi sharoitni isbotlamaydi, balki kerakli haroratni belgilaydi.
Zararli 110°C sozlamasi saqlash bo'limlari yoki plazma qoplari o'sha haroratga yetganini anglatmaydi. Na haqiqiy mahsulot harorati, na ta'sir qilish muddati oshkor qilingan.
Tergovchilar dastlabki kirish usuli, foydalanilgan zaiflik, nazoratchi modellari yoki hujumchilarni ommaviy ravishda aniqlamagan. Sovutish parametrlarining masofadan manipulyatsiyasi xabar qilingan xatti-harakatlarga mos keladi, ammo hodisani ma'lum bir eksploitga bog'lash erta bo'ladi. Taqdim etilgan ma'lumotda plazmaning tasdiqlangan yo'q qilinishi, qon quyishning buzilishi, bemor jarohatlari yoki donor ma'lumotlarining o'g'irlanishi haqida eslatilmagan.
Ushbu hodisa Fransiya supermarket sovutish tizimlariga qilingan hujumlardan keyin sodir bo'lgan, unda hujumchilar uzoq muddatli isitish keltirib chiqarish uchun avtomatik muzdan tushirish (defrost) funksiyalaridan suiiste'mol qilgan. Ushbu hodisalar an'anaviy fayl shifrlovchi ransomware talab qilmasdan, jismoniy buzilish vositasi sifatida qonuniy nazorat funksiyalaridan foydalanish mumkinligini ko'rsatadi. Biroq, ularning Coolworld hujumi bilan texnik aloqasi isbotlanmagan.
Yevropa sovutish sabotaji haqida hisobot Belgiya, Lyuksemburg, Shvetsiya, Irlandiya, Estoniya va Niderlandiya bo'ylab qo'shimcha hodisalarni tasvirlagan. Unda ANSSI ogohlantirishlari Danfoss AK-SM va AK-SC nazoratchilari hamda Copeland va Dixell XWEB tizimlari haqida keltirilgan. Ushbu mahsulot oilalari ta'sirlangan EFS muassasalarida o'rnatilganligi haqida hech qanday dalil yo'q.
Kengroq tashvish ta'minotchi kirish va jismoniy infratuzilma kesishmasida. Sovutish pudratchilari texnik xizmat ko'rsatish ulanishini talab qiladi, ammo buzilgan kirish hujumchilar sog'liqni saqlash tashkilotining asosiy tarmog'iga to'g'ridan-to'g'ri kirishmasa ham, tibbiy saqlash jarayonlarini ochib qo'yishi mumkin. Bu uskunaning yaxlitligi, mustaqil harorat monitoringi va hodisaga javob berish tartiblarini operatsion ustuvorliklarga aylantiradi.
Sanoat va binolar tizimlarining internetga ochiq bo'lishi xavflarini ta'kidlaydigan tadqiqotlar masofadan yetib boriladigan sovutish nazoratlari xavfini ham ko'rsatadi. Tegishli operatsion texnologiya ulanishi bo'yicha yo'riqnoma ochiq interfeyslarni cheklash va ma'muriy ulanishlarni nazorat qilishni ta'kidlaydi.
Sog'liqni saqlash operatorlari uchun mudofaa maqsadi ruxsatsiz parametr o'zgarishlarining oldini olish, shu bilan birga signalizatsiya va javob tartiblari saqlangan mahsulotlar yaroqsiz holga kelishidan oldin xavfli og'ishlarni aniqlashini ta'minlashdir. Nazoratchi buzilishidan keyin har qanday shubhali sovuq zanjir uzilishida mahsulot sharoitlarining mustaqil tekshiruvi muhim bo'lib qoladi.
SOCingizga tezkor to'xtatish uchun ogohlantirish kontekstini bering. 16K SOCdan tahdid razvedkasini integratsiya qiling.
Hackers reportedlytargeted refrigeration equipment operated by Coolworld, a service provider for France’s Établissement Français du Sang (EFS), compromising the safety of blood products intended for medical use.
This attack was detected overnight between November 1 and 2, 2026, and allegedly altered freezer settings from approximately -30°C to 110°C. According to reports, France’s Health Ministry said technicians intervened in time to prevent significant operational disruptions.
The incident primarily affected facilities in Bourgogne-Franche-Comté. Le Canard enchaîné reported the attack on November 3, after an on-call technician noticed abnormal temperature increases.
Initially, EFS described the impacted materials as donor samples used for transfusion monitoring, but later clarified that frozen plasma intended for patient transfusions was also involved.
The critical technical distinction concerns the setpoint: a controller instruction specifying a desired temperature, rather than proof of conditions inside a freezer.
A malicious 110°C setting does not establish that storage compartments, or plasma bags themselves, reached that temperature. Neither actual product temperatures nor the duration of exposure has been disclosed.
Investigators have not publicly identified the initial access method, exploited vulnerability, controller models, or attackers. Remote manipulation of refrigeration parameters remains consistent with the reported behavior, but attributing the incident to a particular exploit would be premature. The supplied account does not mention confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft.
The incident follows attacks against French supermarket refrigeration systems, where intruders reportedly abused automatic defrost functions to cause prolonged heating. Those incidents illustrate how legitimate control features can become tools for physical disruption without requiring conventional file-encrypting ransomware. However, their technical connection to the Coolworld intrusion remains unproven.
A European refrigeration sabotage report described further incidents across Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands. It cited ANSSI warnings concerning Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems. No available evidence establishes that these product families were deployed in the affected EFS facilities.
The broader concern is the intersection of supplier access and physical infrastructure. Refrigeration contractors require maintenance connectivity, but compromised access can expose medical storage processes even when attackers do not directly breach a healthcare organization’s primary network. This makes equipment integrity, independent temperature monitoring, and incident escalation operational priorities.
Related operational technology connectivity guidance emphasizes limiting exposed interfaces and controlling administrative connections. Research into internet-exposed industrial and building systems likewise highlights risks from remotely reachable cooling controls.
For healthcare operators, the defensive objective is preventing unauthorized parameter changes while ensuring alarms and response procedures detect dangerous deviations before stored products become unusable. Independent verification of product conditions remains essential when assessing any suspected cold-chain interruption following controller compromise.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.