Hackers reportedly changed temperature settings on refrigeration equipment used by the French Blood Establishment, EFS, from around −30°C to 110°C after targeting its cooling service provider, Coolworld. The incident happened overnight between November 1 and 2, 2026, and it raised concerns about frozen plasma stored for patient transfusions.
Staff in Bourgogne-Franche-Comté were among those who noticed the problem. France’s Health Ministry said they detected the abnormal temperatures in time and that the incident caused no operational consequences.
Reported temperature change and affected supplies
Coolworld supplies temperature-controlled equipment and maintenance services, including refrigerated containers used in medical settings. An on-call technician reportedly saw temperatures rise during the night, which allowed teams to respond before the disruption affected operations. Initial information concerned donor samples retained for blood safety monitoring, and EFS later told Le Canard enchaîné that frozen plasma intended for transfusions was also involved.
The available reports do not confirm destroyed plasma, disrupted transfusions, or harm to patients. The number of affected units, the length of the disruption, and the temperatures actually reached inside stored products remain undisclosed. No public technical findings identify the attackers or explain how they entered Coolworld’s systems, according to Cyberattaque.
What the temperature figure means
The reported 110°C figure describes a setpoint, meaning the temperature requested through a control system. It does not establish that freezer interiors, blood samples, or plasma bags reached that temperature. Controller settings, measured air temperatures, and temperatures inside stored products are separate readings.
This distinction matters because the risk depends on actual storage conditions and how long products remained outside approved limits. Reporting on the incident says fresh frozen plasma requires storage at −25°C or below. A prolonged temperature rise could make affected supplies unsuitable for transfusion.
Unconfirmed technical details
Investigators have not publicly identified a controller model, exploited vulnerability, or stolen maintenance account. Claims that a specific Danfoss flaw caused this incident would go beyond the available evidence. The reporting also notes that no public evidence connects exposed systems to the EFS incident.
The incident follows earlier attacks against supermarket refrigeration systems, where attackers reportedly changed settings to force continuous defrosting. Similar behavior does not prove that the same attackers, equipment, or entry method were involved at Coolworld. An October 12 CERT-FR security alert confirmed numerous compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell XWEB systems.
CERT-FR and monitoring advice
CERT-FR recommends removing public internet access, reviewing full device configurations, checking defrost schedules, and restoring remote access only through secure VPNs or protected networks. Supported equipment should receive firmware updates, default passwords must be changed, and applicable security settings should be enabled. Cybersecurity News also documented internet-facing Danfoss systems, while noting that search results alone do not establish whether individual devices are vulnerable or compromised.
For healthcare providers, the reported incident highlights risks extending beyond stolen records. A supplier compromise can affect equipment that preserves essential medical products. Independent temperature monitoring and prompt staff response were important safeguards here, although the full technical cause remains unknown. Available reporting contains no confirmed theft of donor information.
Licensed under CC BY-ND 4.0 International