France's national blood service has confirmed that a cyberattack on a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products — the first time Europe's wave of refrigeration hacks has reached a medical supply chain.

Source: BleepingComputer, Nov 4, 2026 (EFS statement)

The French Blood Establishment (Établissement français du sang, or EFS), which manages blood collection, processing and distribution across France, said the incident occurred overnight between November 1 and November 2 and affected systems used to monitor and control cold-storage chambers. The chambers store blood products before they are distributed to hospitals, as well as biological samples maintained by the service. In a statement published on November 3, EFS said it was not directly targeted — the attack hit its refrigeration supplier.

French media reports, led by the weekly Le Canard enchaîné, say the attackers tried to change freezer settings from about minus 30 degrees Celsius to 110 degrees Celsius. That figure is the setting programmed into the controllers, according to those reports — there is no confirmation the stored plasma ever reached such a temperature, and EFS's own statement speaks only of temperature and defrost thresholds raised "to extremely high levels". The Associated Press confirmed the attack sought to raise temperatures but was stopped before products were compromised.

EFS says its monitoring and alarm systems quickly detected the abnormal settings, allowing staff to fix the affected equipment or transfer products to other refrigeration facilities. Plasma bags intended for transfusions and plasma used to manufacture medicines were either transferred or secured, preventing damage. "No health impact has been identified, and no loss of blood products has been reported," EFS said in its statement. Blood collection and distribution operations continued without interruption, and EFS president Frédéric Pacoud told BFMTV there was "no compromise to the safety of blood products".

EFS has not named the supplier in its statement. European refrigeration equipment provider Coolworld Rentals confirmed separately that a cybersecurity incident involving remote-monitoring software had affected a limited number of its units, and that the attackers exploited a vulnerability in a third-party component. "The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld's direct control," the company said. "Only a limited number of Coolworld units were affected, and Coolworld responded promptly and took appropriate measures."

EFS technical teams are working with France's national cybersecurity agency, ANSSI, and the Ministry of Health, and the service has strengthened monitoring of refrigeration equipment and temperatures. The attack has not been publicly attributed to any group or state, and officials have not identified it as a ransomware attack. No breach of EFS's own information systems or donor data has been publicly confirmed.

Part of a Europe-wide wave of refrigeration attacks

The blood-service incident follows the supermarket refrigeration attacks that spread across 11 European countries this autumn, which European officials have been coordinating a response to. Read: Supermarket cyberattacks in 11 countries draw an EU response

In October, cyberattacks disrupted refrigeration at an estimated 250 to 350 French supermarkets, including Intermarché, Carrefour Market, Monoprix, Leclerc and Super U, BleepingComputer reported. In those attacks, hackers reportedly compromised refrigeration controllers running older Danfoss software and remotely activated defrosting functions, raising temperatures and forcing stores to discard fresh and frozen products. A second wave this month affected more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; at one Swedish store the system reportedly began generating heat, and another reported temperatures changed to 50 degrees Celsius. Belgian refrigeration company Sabcobel has said the November attackers exploited the same vulnerability used in October — a claim that has not been independently established for the EFS incident.

In 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451, which could let attackers bypass authentication and execute commands remotely. It has not been confirmed whether those flaws are the ones exploited in any of the current attacks, including the one on the blood service's supplier.