France's national blood service confirmed that a cyberattack against one of its refrigeration equipment suppliers caused temperature and defrost controls to malfunction at three storage locations, putting blood inventory at risk.
The French Blood Establishment (Établissement français du sang or EFS), responsible for blood collection, processing and distribution nationwide, reported the incident took place on November 2. The attack compromised systems that monitor and regulate cold-storage chambers used to preserve blood products and biological samples.
EFS was not the direct target; instead, attackers went after its refrigeration supplier. European refrigeration provider Coolworld Rentals acknowledged that a cybersecurity incident involving its remote monitoring software had affected a limited number of its units. The company stated that "The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld's direct control." Coolworld added that it "responded promptly and took appropriate measures" but declined to discuss individual customer cases.
At EFS facilities, attackers pushed temperature and defrost thresholds to dangerously high levels. However, the organization's monitoring and alert systems detected the changes rapidly, enabling staff to either repair the affected equipment or relocate products to backup refrigeration. EFS reported that "No health impact has been identified, and no loss of blood products has been reported." The agency confirmed that plasma bags designated for transfusions and plasma destined for pharmaceutical manufacturing were either moved or protected, avoiding product damage. Blood collection and distribution operations proceeded without disruption.
EFS is collaborating with France's national cybersecurity authority (ANSSI) and the Ministry of Health on the investigation. The organization has increased surveillance of refrigeration equipment and temperature monitoring.
Part of a broader European campaign
The blood service incident is the latest in a series of coordinated refrigeration system attacks sweeping across Europe. Attackers have been remotely changing temperature settings or triggering defrost cycles that disable cooling functions.
In October, cyberattacks struck an estimated 250 to 350 French supermarkets, including Intermarché, Carrefour Market, Monoprix, Leclerc, and Super U. Attackers compromised older versions of Danfoss refrigeration control software and remotely activated automatic defrosting, causing temperatures to rise and forcing stores to discard perishable inventory. The attacks targeted Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB refrigeration controllers, which manage cooling equipment from remote locations.
A subsequent wave of attacks this month impacted more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Some systems were shut down entirely, while others had their temperature settings altered remotely. At a Swedish supermarket, the system began producing heat; at another location, temperatures were changed to 50°C (122°F). Belgian refrigeration firm Sabcobel stated that the November attacks exploited the same vulnerability leveraged in the October supermarket campaign.
Vulnerability disclosure and attribution
In 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed two vulnerabilities in Danfoss AK-SM 8xxA controllers, identified as CVE-2025-41450 and CVE-2025-41451. Both flaws permit attackers to circumvent authentication mechanisms and run arbitrary commands on affected systems, potentially granting them full control of refrigeration infrastructure. Whether these specific vulnerabilities are being exploited in the current attacks remains unconfirmed.