Threat intel
Supplier hack reaches France's blood bank cold rooms
An attack on a refrigeration supplier changed cold room settings at three EFS blood service sites. What is confirmed, what is not, and what to check.
On Monday, November 2, attackers changed the settings of cold rooms holding plasma at three sites of the Etablissement français du sang (EFS), France's national blood service. EFS said late on Tuesday that it was not the target: one of its refrigeration equipment suppliers had suffered a cybersecurity incident, and the supplier's supervision and remote control systems raised "temperature and defrosting thresholds" to very high levels. The rooms held plasma for transfusion, plasma for making medicines and donor samples.
The alarms worked. EFS says its monitoring caught the change quickly, staff brought the equipment back under control or shut it down, and stock was moved elsewhere as a precaution. No blood product was lost, no health impact has been identified, and collection and distribution carried on. ANSSI, the national cybersecurity agency, and the Health Ministry are investigating. Any hospital, laboratory, pharmacy or biobank whose freezers a supplier manages remotely has the same exposure.
What is confirmed and what is not
Le Canard Enchaîné broke the story and named the supplier as Coolworld. EFS has not named it. Coolworld said on November 4 that it "is aware" of a cybersecurity incident, that the weakness lies in "a component from a third-party supplier" outside its direct control, and that only a limited number of its units were affected. It did not name the component or its maker.
The temperature figures need care. Le Canard Enchaîné reported that rooms normally held at about -30°C were programmed to reach 110°C; other outlets give the normal storage temperature as -25°C. A programmed value is a setpoint, the target the controller works towards, not a measured temperature. EFS told The Connexion it had not released figures and could not confirm 110°C. Euronews reports EFS saying that temperature was never reached, while an EFS collection and production director told the broadcaster ICI that readings went to "110 or even 150 degrees". Treat 110°C as a press-reported setpoint until EFS or the ministry publishes figures.
The Health Minister's office says remote access to the affected equipment has been cut, monitoring of the installations and storage conditions reinforced, and products moved. It says technical work continues on how the attackers got in, how many devices were involved and when the rooms can go back into service. No group has claimed the attack.
How it works
A cold room or plasma freezer has a local controller that holds the setpoint and runs the compressor, fans and defrost heaters. Defrost is routine: heaters melt ice off the evaporator coil, and the controller ends the cycle when the coil reaches a termination temperature or a maximum time runs out. Above the controllers, the supplier's supervision platform collects readings and lets technicians change parameters remotely, which is how one maintenance contract can cover many sites.
Whoever controls that platform can rewrite the setpoint, the defrost termination temperature and the defrost duration across every room it reaches. Raising those values keeps the heaters running against the stock. If the alarm limits are held in the same platform, they can be moved too, so the supplier's own alerts stay quiet.
That is why the EFS result matters. Stéphane Noël, the EFS director for Hauts-de-France and Normandy, told France 3 that EFS has its own monitoring systems, independent of the refrigeration supplier's, and alarms and procedures that let staff react quickly. The alarm that worked did not depend on the platform that had been altered.
How this differs from the supermarket attack
In October we covered hijacked Danfoss controllers in French supermarkets, where CERT-FR named the controller models and the stores lost stock. At EFS, no controller brand has been named and the route in was a supplier's remote management, with a third-party component inside the supplier's product as the reported weak point. Patching your own controllers does not close that path: the risk sits with the supplier's platform and whatever it is built on.
AP reported this week that remotely hijacked fridges and freezers have warmed up in supermarkets in several European countries. Authorities have not said whether they are linked to the EFS incident.
What to do
Start with a list. For every cold room, freezer, refrigerator and building management system (BMS) controller, record who installed it, who can change its settings remotely and how: a supplier cloud portal, a VPN, a public IP address or a cellular modem in the cabinet. Then ask each supplier for the components between their technicians and your equipment, such as gateways, remote monitoring software and remote access tools, with versions.
- Remove direct internet exposure. Search your public IP ranges in Shodan or Censys for controller and supervisor web interfaces, look for firewall rules forwarding HTTP or HTTPS to a controller, and find cellular routers that bypass your firewall entirely.
- Change every default password on controllers, supervisors and gateways, and replace shared supplier logins with named accounts.
- Put supplier access through a path you control, such as a VPN or jump host with multi-factor authentication, enabled per session on request and logged.
- Give critical storage independent temperature monitoring: loggers from a different vendor, on a separate network or cellular link, with alarm limits the refrigeration supplier cannot change. Send alarms to an on-call person around the clock and test the full alarm path regularly.
- Check whether settings have already been touched. Compare current setpoints, defrost termination temperatures, defrost durations and schedules, and alarm limits with the commissioning records. Review the supervisor's event log and the supplier portal's audit log for parameter changes outside working hours, especially overnight.
- Write the incident into the contract: how fast the supplier must tell you about a compromise, your right to cut its remote access at once, and an updated list of subcontracted components whenever it changes.
Agree in advance where stock goes if a room fails, who moves it and how fast. EFS could move plasma to other facilities; a single-site clinic or biobank needs a spare freezer or an arrangement with a neighbour.
Fallbacks decide the cost
Ahold Delhaize, whose October shutdown we covered, said on November 4 that the attack will cost it up to €250 million in sales and up to €100 million in operating income in the fourth quarter. EFS lost no product because its fallback was in place before the attack: separate sensors, staff who answered the alarm and other facilities to take the plasma.
Our attack surface management work finds exposed controllers, supervisors and supplier gateways on your IP ranges, and our safeguarding and hardening team can move supplier access behind a path you control without losing temperature records. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: AP via WPXI, franceinfo, ICI, RTBF, France 3 Normandie, Techniques de l'Ingénieur (AFP), Euronews, The Connexion, The Next Web, RetailDetail on Ahold Delhaize.