Cyberattack Alters Blood-Storage Refrigeration Settings at Three French Facilities
Summary
A cyberattack on an unnamed refrigeration supplier altered cold-storage settings at three French Blood Establishment facilities. EFS secured or transferred plasma and reported no product losses or health impacts; exploitation of known Danfoss flaws remains unconfirmed.
Key points
- EFS said the November 2 incident affected systems monitoring and controlling cold-storage chambers at three facilities; the attack targeted a supplier, not EFS directly.
- Coolworld Rentals separately reported a cybersecurity incident involving remote monitoring software and said a vulnerability in a third-party component was involved.
- The incident raised temperature and defrost settings. EFS monitoring and alarms detected the changes, and staff repaired equipment or transferred products.
- EFS said plasma products were transferred or secured, no blood-product losses or health impacts had been reported, and operations continued without interruption.
- EFS is working with ANSSI and the Ministry of Health and has strengthened monitoring of refrigeration equipment and temperatures.
- Related attacks have affected refrigeration systems at European supermarkets. CISA disclosed CVE-2025-41450 and CVE-2025-41451 in Danfoss controllers, but their exploitation in these attacks has not been confirmed.
Article Details
- Victim Organization
- French Blood Establishment (Établissement français du sang or EFS)
- Incident Type
- Cyberattack on a refrigeration equipment supplier affected systems monitoring and controlling cold-storage chambers at three EFS facilities; temperature and defrost settings were raised.
- Incident Date
- 2026-11-02
- Disclosure Date
- 2026-11-03
- Operational Impact
- Temperature changes threatened stored blood products and biological samples. EFS staff detected the changes and repaired or transferred affected equipment and products. Plasma was transferred or secured; no loss of blood products or health impact was reported, and collection and distribution continued without interruption.
- Claim Status
- confirmed
CVE
CVE-2025-41450Vendor / Product unavailableCybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451.CVE-2025-41451Vendor / Product unavailableCybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451.
Vendors
Coolworld RentalsWhile EFS has not named the affected supplier, European refrigeration equipment provider Coolworld Rentals confirmed in a statement that a cybersecurity incident involving remote monitoring software had affected aCopelandThese attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which are used to monitor and manage cooling equipment remotely.DanfossIn those attacks, hackers reportedly compromised refrigeration controllers running older Danfoss software and remotely activated automatic defrosting functions, raising temperatures and forcing stores to discard freshDixellThese attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which are used to monitor and manage cooling equipment remotely.
Products
Copeland/Dixell XWEBThese attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which are used to monitor and manage cooling equipment remotely.Danfoss AK-SM 8xxACybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities affecting Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451.Danfoss AK-SM/AK-SCThese attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which are used to monitor and manage cooling equipment remotely.
Countries
BelgiumA second wave of attacks occurred this month, affecting more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.EstoniaA second wave of attacks occurred this month, affecting more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.FranceCyberattack disrupts blood storage refrigeration systems in FranceIrelandA second wave of attacks occurred this month, affecting more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.LuxembourgA second wave of attacks occurred this month, affecting more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.NetherlandsA second wave of attacks occurred this month, affecting more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.SwedenA second wave of attacks occurred this month, affecting more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia.