Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Hackers reportedlytargeted refrigeration equipment operated by Coolworld, a service provider for France’s Établissement Français du Sang (EFS), compromising the safety of blood products intended for medical use.

This attack was detected overnight between November 1 and 2, 2026, and allegedly altered freezer settings from approximately -30°C to 110°C. According to reports, France’s Health Ministry said technicians intervened in time to prevent significant operational disruptions.

The incident primarily affected facilities in Bourgogne-Franche-Comté. Le Canard enchaîné reported the attack on November 3, after an on-call technician noticed abnormal temperature increases.

Initially, EFS described the impacted materials as donor samples used for transfusion monitoring, but later clarified that frozen plasma intended for patient transfusions was also involved.

The critical technical distinction concerns the setpoint: a controller instruction specifying a desired temperature, rather than proof of conditions inside a freezer.

A malicious 110°C setting does not establish that storage compartments, or plasma bags themselves, reached that temperature. Neither actual product temperatures nor the duration of exposure has been disclosed.

Investigators have not publicly identified the initial access method, exploited vulnerability, controller models, or attackers. Remote manipulation of refrigeration parameters remains consistent with the reported behavior, but attributing the incident to a particular exploit would be premature. The supplied account does not mention confirmed plasma destruction, compromised transfusions, patient injuries, or donor-data theft.

The incident follows attacks against French supermarket refrigeration systems, where intruders reportedly abused automatic defrost functions to cause prolonged heating. Those incidents illustrate how legitimate control features can become tools for physical disruption without requiring conventional file-encrypting ransomware. However, their technical connection to the Coolworld intrusion remains unproven.

A European refrigeration sabotage report described further incidents across Belgium, Luxembourg, Sweden, Ireland, Estonia, and the Netherlands. It cited ANSSI warnings concerning Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems. No available evidence establishes that these product families were deployed in the affected EFS facilities.

The broader concern is the intersection of supplier access and physical infrastructure. Refrigeration contractors require maintenance connectivity, but compromised access can expose medical storage processes even when attackers do not directly breach a healthcare organization’s primary network. This makes equipment integrity, independent temperature monitoring, and incident escalation operational priorities.

Related operational technology connectivity guidance emphasizes limiting exposed interfaces and controlling administrative connections. Research into internet-exposed industrial and building systems likewise highlights risks from remotely reachable cooling controls.

For healthcare operators, the defensive objective is preventing unauthorized parameter changes while ensuring alarms and response procedures detect dangerous deviations before stored products become unusable. Independent verification of product conditions remains essential when assessing any suspected cold-chain interruption following controller compromise.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.