Hackers set cold rooms at three sites of France’s EFS blood service to 110°C

Cold room settings changed remotely

EFS (Établissement français du sang), France’s national blood service, runs the country’s blood donation and transfusion chain with 13 regional establishments and nearly 10,000 staff. In a statement released Nov. 3, EFS said monitoring and control systems for cold rooms at three regional sites were hit on Monday, Nov. 2. Temperature and defrosting thresholds were raised to “extremely high levels,” it said.

According to Le Canard enchaîné, the weekly that first reported the incident, the attack took place overnight from Nov. 1 to 2. Rooms kept at minus 30 degrees were programmed to reach 110°C, the paper said. That figure is a setting; EFS has not disclosed any measured temperature. The rooms held donor samples, plasma bags for transfusion and plasma for drug manufacturing, which EFS supplies to its partner LFB.

Dr. Christophe Barisien, director of collection and production at EFS Bourgogne-Franche-Comté, told local broadcaster ICI that the affected freezers store products at minus 25 degrees. He said temperatures “went up to 110 or even 150 degrees,” without specifying whether he meant settings or readings.

The attack came through a supplier

According to Politico, EFS was not the direct target. Its statement says the affected rooms were “equipped with the supplier’s solution.” Le Canard, not EFS, named the supplier: Coolworld, a company based in Waalwijk, the Netherlands, that rents out temporary cooling and cold storage.

Coolworld’s Nov. 4 statement, which does not mention EFS, ties the incident to remote monitoring software used in refrigeration systems. The flaw lies in “a component supplied by a third-party provider and not directly controlled by Coolworld,” and only a limited number of units were affected, it said. The component’s maker has not been named. ICI reported that Besançon is one of the three sites; the other two have not been identified.

Alarms and an on-call technician

An EFS spokesperson told Le Canard that an on-call technician noticed the cold store temperature rising overnight from Sunday into Monday. EFS said its monitoring and alarm systems quickly detected the anomalies. According to Barisien, independent temperature monitors flagged the rise, and teams moved the products or regained control of the settings.

EFS says there was no health impact and no loss of blood products. Remote access to the affected equipment was cut, products were moved to other sites as a precaution and monitoring was tightened. Blood collection and distribution continued. EFS president Frédéric Pacoud told BFMTV that samples or plasma bags meant for patients could have been lost.

Health Minister Stéphanie Rist’s office said investigators are examining the method used, the number of devices involved and when the sites can return to service. EFS is working with ANSSI, France’s national cybersecurity agency.

Supermarkets in October, Europe in November

According to Reuters, overnight on Oct. 11-12, fridges and freezers at hundreds of French supermarkets were heated to as high as 50°C, causing fires and spoiling food. Danfoss said the affected units “were running outdated firmware” and, according to The Hacker News, that most were older AK-SM 800 and AK-SC 355 models it no longer updates.

An alert from CERT-FR, France’s government cyber response team, issued Oct. 12 and updated Oct. 16, reports numerous compromises of Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB units. It advises taking the devices off the internet, checking defrost schedules and changing default passwords. For devices without security fixes, it warns, a factory reset is not enough.

According to the BBC, supermarket freezers were hit on the same night as the EFS incident, in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. The Hacker News also listed Portugal and Italy. Belgian refrigeration company Sabcobel said evaporators were switched to defrost mode. Danfoss said the affected Dutch systems were not on a secure network and still used default passwords.

No culprit identified

No one has claimed the attacks. Politico said the EFS incident appears linked to the supermarket wave, but officials have not confirmed a connection. Belgium’s Centre for Cybersecurity said the perpetrators may never be identified. Rafe Pilling of Sophos told The Guardian that state signaling and a lone hacker were the two most plausible scenarios. Because no malware was needed, he said, little trace was left. French digital minister Anne Le Hénanff told the Senate the attacks “have directly targeted our economy and our supply chain.”

What role AI played

There is no claim or evidence that AI was used in the attacks. According to Reuters, officials at the UK’s National Cyber Security Centre (NCSC) said advanced AI probably was not needed, because the attacks targeted known flaws in old technology.

In a Nov. 3 speech, NCSC chief Richard Horne called the fridge attacks “just the foothills.” The issue, he said, is not that AI has invented new ways to attack. Long-tolerated vulnerabilities can now be found and exploited at a scale that was once unimaginable. The NCSC’s annual report says a ransomware attack using AI-powered malware on UK critical infrastructure is highly likely by 2028.

Cover image generated with AI.