French blood bank cyberattack: Europe’s cold-chain hack wave

Attackers raised the temperature and defrost thresholds on plasma cold rooms at three regional sites of the Établissement français du sang (EFS), France’s national blood service, overnight on 1 to 2 November 2026, through remote monitoring software run by its refrigeration contractor Coolworld. Le Canard enchaîné, which broke the story in its 4 November edition, reported that rooms held at minus 30°C were set to climb to 110°C. A duty technician and EFS’s own temperature alarms caught the rise, the plasma and samples were moved to other sites, and EFS says no blood products were lost and no patient was affected.

It is the first healthcare target in a run of attacks on internet-connected refrigeration controllers that began with about 700 French supermarkets on the night of 11 to 12 October, reached more than 100 shops in nine other European countries on 2 November and has since touched meat processors in the UK. Two pro-Russian hacktivist groups claimed the supermarket attacks on Telegram on 4 November and deleted the claim within hours. Nobody has claimed the blood bank, and French officials have not linked the two.

In brief

• Cold rooms at three EFS cold-storage sites, one of them Besançon in Bourgogne-Franche-Comté, had their thresholds changed in the early hours of 2 November. They held plasma bags for transfusion and for fractionation into medicines, plus donor samples for EFS biobanks. EFS’s statement of 3 November reports no loss of product, no health consequences and no interruption to supply for the roughly 1,900 hospitals and clinics it serves.
• The way in was Coolworld, a cold-room and refrigerated-container rental firm. Its notice of 4 November blames remote monitoring software built on a component from a third party it does not control, on a limited number of units. Neither Coolworld nor EFS has named the component or its maker.
• CERT-FR alert CERTFR-2026-ALE-012, issued on 12 October and updated on 13 and 16 October, names the equipment compromised in the supermarket attacks as the Danfoss AK-SM and AK-SC series and the Copeland and Dixell XWEB supervisors, and says the campaigns are probably still running.
• ANSSI’s director general, Vincent Strubel, told the French Senate on 21 October that the supermarket attackers used controllers exposed to the internet and protected by weak passwords, and that the same equipment runs in research laboratories and pharmacies storing vaccines. A supplier to the blood service was hit twelve days later.
• Forescout counted 12,976 internet-exposed refrigeration management services on 6,017 IP addresses in 99 countries on 22 October, 7,075 of them Copeland or Dixell XWEB, and has tracked more than 20 claimed attacks on refrigeration systems since January, most by Z-Pentest Alliance and NoName057(16).
• On 2 November Delhaize reported refrigeration failures in several dozen shops in Belgium and Luxembourg, Carrefour in about 15 Belgian stores, Colruyt in five Spar franchises, Coop in seven Swedish stores, Musgrave in 13 SuperValu stores in Ireland and Intermarché in seven Portuguese stores. Belgian prosecutors opened a criminal investigation the same day.
• NoName057(16) and Z-Pentest Alliance claimed the supermarket attacks on 4 November and posted what they said were 2,500 lines of Danfoss employee and customer logins. The posts are gone, no researcher has confirmed them, and the groups did not mention EFS.

What happened at the French blood bank?

Someone logged into the supervision system for EFS cold rooms at three sites and turned the temperature and defrost thresholds up. EFS, the sole civilian collector of donated blood in France and the supplier of about 1,900 hospitals and clinics, said in a statement late on 3 November that a cybersecurity incident on Monday 2 November had affected the monitoring and control installations for cold rooms at three regional sites, that anomalies were reported, and that the operating parameters of cold rooms fitted with the contractor’s system had been altered. Its monitoring and alarm systems, it said, identified the anomalies quickly enough for staff to act, and depending on the site the equipment was either brought back under control without any effect on the contents or shut down and the contents moved elsewhere. “No health consequences have been identified, and no blood products were lost,” the statement said. Blood collection and distribution were not interrupted.

Le Canard enchaîné, under the headline “Les hackers ont du sang sur les mains”, filled in what the statement left out. The rooms held frozen plasma destined for transfusion and for fractionation into medicines, as well as samples for the EFS biobanks. Chambers that run at minus 30°C were set to reach 110°C. The regional press named Besançon as the affected site in Bourgogne-Franche-Comté; EFS has not named the other two. A technician on overnight duty noticed the temperatures climbing, which is how a change made in the middle of the night came to be reversed before the morning. EFS president Frédéric Pacoud told BFMTV there had been no impact on the safety of any product, and EFS has been careful to say it was not itself the target: the intrusion happened at a supplier, and the Health Ministry, which confirmed the incident on 4 November, has given no indication of who was behind it. ANSSI, the national cybersecurity agency, is investigating alongside the ministry, and EFS says it has tightened temperature monitoring across all of its equipment.

How did the attackers get in?

Through the contractor’s remote monitoring software, which is also how the supermarkets were reached in October. Coolworld, which rents cold rooms and refrigerated containers and maintains them for clients including EFS, published a cybersecurity notice on 4 November confirming an incident involving remote monitoring software used in refrigeration systems. The weakness, it said, was in a component supplied by a third party and not under Coolworld’s direct control, and only a limited number of units were affected. It did not name EFS, the component or the manufacturer, and nobody else has either.

The October attacks ran the same way. Les Mousquetaires, the owner of Intermarché and Netto, told CNBC the attack came through a service provider responsible for the refrigeration in some of its stores, and E.Leclerc told AFP one of its refrigeration suppliers had been hit. An internal Intermarché memo seen by BFMTV on the morning of 12 October described a cyberattack overnight “at Danfoss”, the Danish manufacturer whose AK-SM and AK-SC supervisors sit above the individual case and compressor controllers in a store and let a maintenance firm adjust every cabinet from its own office. A supermarket manager near Dijon told NPR a monitoring company phoned him at four in the morning to say his cold rooms were warming; by the time he arrived the freezers were, in his words, practically ovens. CERT-FR’s alert CERTFR-2026-ALE-012, issued that day, reported numerous compromises of Danfoss AK-SM and AK-SC units, added the Copeland and Dixell XWEB supervisors the next day, and noted that putting a management interface of this kind on the internet is contrary to basic practice. Danfoss said most of the hijacked units were legacy products that no longer receive software or security updates, with some current AK-SM 800A units on outdated firmware; Copeland said in a statement to ACHR News that it acknowledged a vulnerability in a discontinued, end-of-life generation of its controllers.

Nobody needed an exploit. Vincent Strubel, who runs ANSSI, told the Senate’s foreign affairs and defence committee on 21 October that the controllers were reachable directly from the internet and protected by weak passwords, and that was enough. The exploits existed anyway. On 9 August Claroty’s Team82 published 23 vulnerabilities in Copeland’s XWEB Pro platform, 21 of them high severity: an authentication bypass triggered by sending an unrecognised login mode (CVE-2026-25085), administrator passwords derived from the date, the device’s MAC address and keys hard-coded in the firmware (CVE-2026-21718), and 19 command-injection bugs that give root on the box. In their lab the researchers set a controller’s temperature anywhere from minus 50°C to 110°C, switched the compressor, fans and defrost on and off, and showed that a cabinet could warm up without the display raising an alarm. Copeland fixed the lot in firmware 1.13 before the research went public. The same team published flaws in Danfoss’s AK-SM 800A web interface the same month. Whether any of these were used in France, or whether a default password did the job, has not been said publicly, and for an end-of-life controller on a public IP address the distinction hardly matters.

How far has the refrigeration attack wave spread?

Ten countries, three sectors and, possibly, a dozen US military commissaries in August. The sequence below is compiled from CERT-FR, EFS, Claroty, Forescout and press reporting.

Date	What happened
9 August 2026	Claroty Team82 publishes 23 vulnerabilities in Copeland XWEB Pro controllers and separate flaws in Danfoss AK-SM 800A. Patches are already out.
Late August 2026	Freezers at about a dozen US military commissaries run by DeCA overheat and spoil food. The Pentagon’s Defense Criminal Investigative Service later treats it as a suspected hack and works with French investigators.
11 to 12 October 2026	Controllers at around 700 French supermarkets are forced into defrost overnight: 300 Intermarché and Netto stores by BFMTV’s count (the owner says about 150), 80 Carrefour, fewer than 100 Coopérative U, about 30 Monoprix and several E.Leclerc. Cabinets reach 50°C; fires reported. A Sekoia analyst tells Reuters that Spain, Portugal, Poland, Germany and Belgium saw the same.
12 to 16 October 2026	CERT-FR issues CERTFR-2026-ALE-012, extends it to Copeland and Dixell XWEB on 13 October and revises its recommendations on 16 October. The Paris prosecutor opens an investigation and hands it to the anti-cybercrime office OFAC.
21 October 2026	ANSSI director general Vincent Strubel tells the Senate the attackers used exposed devices and weak passwords, and that the same equipment runs in laboratories and pharmacies.
22 October 2026	Forescout Vedere Labs publishes a scan showing 12,976 internet-exposed refrigeration services in 99 countries.
1 to 2 November 2026	Cold rooms at three EFS sites are set to overheat through contractor Coolworld. Caught overnight, nothing lost.
2 November 2026	More than 100 shops in Belgium, Luxembourg, the Netherlands, Sweden, Ireland, Portugal, Estonia, Denmark and Finland lose refrigeration. Belgian prosecutors open a criminal investigation.
3 November 2026	UK meat processors report impacts; NCSC chief Richard Horne calls the wave “just the foothills”. EFS issues its statement that evening.
4 November 2026	Le Canard enchaîné publishes the EFS story and the Health Ministry confirms it. NoName057(16) and Z-Pentest Alliance claim the supermarket attacks on Telegram, then delete the posts.

France in October was the big one. Economy Minister Roland Lescure put the count at 700 stores, about 7% of the 10,000 food retail outlets in the country, and Les Mousquetaires said cabinets in about 150 of its stores sat at 50°C for six hours. Coopérative U’s president, Dominique Schelcher, called it unprecedented; losses were first estimated at 300,000 euros and have since been described in the millions. The 2 November wave was shallower in each country and much wider. Delhaize counted several dozen shops in Belgium and Luxembourg, four of them in Luxembourg; Carrefour about 15 of its 700 Belgian stores; Colruyt five Spar franchises; IKEA one store in Mons; Coop seven of its 800 Swedish stores; Musgrave 13 SuperValu stores in Ireland; Intermarché seven stores in Portugal, through an external refrigeration management provider. De Laet & Van Haver, a Belgian butchery chain, said the fridges at its Hove store reached 18°C and about 15,000 euros of meat went in the bin. In the UK the NCSC worked through the night of 2 November alerting firms it judged vulnerable; Richard Horne told BBC Radio 4 the next morning there were handfuls of organisations alerted and a couple of impacts, and ITV reported that meat processors were among them. EU Agriculture Commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt the food supply.

How much is left to hit is a known number. Forescout’s Vedere Labs scanned the internet on 22 October and found 12,976 refrigeration management services on 6,017 public IP addresses in 99 countries and territories, across ten product families; 7,075 were Copeland or Dixell XWEB panels, with Danfoss StoreView next. Some of the exposed services answered with firmware versions carrying known vulnerabilities. The same report counts more than 20 claimed attacks on refrigeration systems since January 2026, most of them by Z-Pentest Alliance and NoName057(16), with fruit stores, wineries, supermarkets and food processors among the targets; Z-Pentest claimed ten on 26 April alone, usually by changing temperature and defrost settings through an exposed web interface. Forescout also quotes a Danfoss technical bulletin from October 2025 which refers to attacks in 2022 on 16 Russian supermarkets and 40 Israeli stores whose installations had no firewall or VPN in front of them. The method is at least four years old; the October campaign was the first time it was run against several hundred sites in one night.

Who is behind the attacks?

Nobody has been identified, and the only claim on the table has been withdrawn. On 4 November the Telegram channels of NoName057(16), the pro-Russian DDoS collective active since March 2022, and Z-Pentest Alliance, a group formed in late 2024 by veterans of NoName057(16) and the Cyber Army of Russia Reborn, announced joint responsibility for the supermarket attacks. As proof, NoName057(16) said it was releasing a sample of more than 2,500 lines of Danfoss employee and customer logins and passwords; Z-Pentest’s post blamed “systemic negligence” by European and American operators rather than any skill of its own. Both channels were deleted within hours. CyberKnow, who tracks the groups, reshared the claims while doubting the groups had breached anything, suggesting they had claimed credit once the story was in the news, and no researcher has independently tied either group to the October or November intrusions. Neither post mentioned EFS or Coolworld.

The investigators are keeping their options open. Daniel dos Santos of Forescout told Bloomberg on 2 November that the evidence pointed away from a financial motive and towards “very likely someone sending a message to society”, while noting that an ordinary IT fault had not been ruled out; he likened the exposed controllers to space junk, launched years ago and never retrieved. Researchers quoted in the UK press listed Russian hacktivists, an Iranian hacktivist group, a state operation and a lone prankster as the live possibilities, and Belgium’s Centre for Cybersecurity said the culprits may never be determined. Belgian prosecutors opened a criminal investigation on 2 November, the Paris prosecutor’s case from October sits with OFAC, and the Pentagon’s Defense Criminal Investigative Service and the Army CID’s cyber field office are working with French law enforcement over the August commissary freezers, which also ran on Danfoss equipment. As of 4 November the French authorities had not connected the Coolworld intrusion to the supermarket wave, although it happened the same night as the 2 November attacks and through the same kind of remote refrigeration management.

The blood bank story also produced its own small disinformation puzzle. Within hours of it breaking, posts on X asked why non-French outlets appeared to have reported it first and whether the story had been seeded abroad. The sequence is less interesting than that: Le Canard enchaîné carried it in the edition dated 4 November, EFS put out its statement late on 3 November, the Associated Press wire ran on the morning of 4 November, and syndication sites in India, the Gulf and elsewhere republished the wire within minutes, which is why they outrank French outlets in search for the first few hours of most French stories.

What should hospitals, blood services and cold-chain operators do?

Get the controllers off the public internet, then fix the maintenance contract. CERT-FR’s instructions, in the order it gives them:

• Remove direct internet exposure from every refrigeration controller and supervisor, including units reachable on a public IP address through the maintenance contractor. CERT-FR specifically advises checking the insurance policy before cutting the contractor’s data link.
• Restore the contractor’s remote access only through a VPN or a protected network. A firewall rule allowing the contractor’s source addresses is acceptable for a few days, not as the fix.
• Review the whole configuration, defrost schedules in particular, against the last known-good settings.
• Update the firmware. On Danfoss units set the security level to Strict and confirm the default passwords are gone. Dixell has published its own hardening guide for XWEB supervisors, linked from the alert.
• Treat a compromised end-of-life device as unrecoverable. CERT-FR’s wording is that a factory reset alone is insufficient because the device remains vulnerable and will very probably be compromised again.

Healthcare sites have a narrower margin than a supermarket. A cabinet of yoghurt at 50°C is a write-off; a cold room of plasma or vaccines is a supply problem for the hospitals downstream, which is why Strubel singled the sector out on 21 October and why ANSSI says it went to healthcare operators after the supermarket attacks to check their equipment. Neither ANSSI nor EFS has said whether Coolworld’s units were part of that check. What got EFS through the night was independent of the controller: a temperature alarm system that does not share a supplier, a network or a login with the thing it watches, and a person on duty to answer it. Any site holding plasma, vaccines, reagents or samples should have both, plus a written plan for where the product goes when the alarm sounds, because the contents were moved in Besançon within hours and that is the difference between an incident and a loss.

The contract is where the exposure usually lives. Supermarkets in France outsource refrigeration to maintenance firms, and ANSSI can advise retailers on how that equipment is connected but, as Le Monde Informatique noted, cannot impose rules on them; the same is true of a cold-room rental company serving a blood bank. Ask the contractor for a written inventory of every controller and supervisor on site, with model, firmware version and the path used to reach it, and put the exposure rules above into the service agreement. SNEFCCA, the French trade body for about 1,300 refrigeration and kitchen-equipment firms, said its members responded in October by disconnecting systems quickly; the question for every operator is whether their own contractor did. Nothing in this wave looks like ransomware, and nothing from it appears on Ransomtracker: no encryption, no extortion note, no leak-site listing. Forescout’s description is the right one, unauthorised use of legitimate functions, with no malware involved, which means a defrost command sent by someone holding the contractor’s password is indistinguishable from one sent by the contractor. The containment steps in our incident response runbook still apply; the asset is a compressor rather than a file server.

Frequently asked questions

Sources and further reading

• CERT-FR: CERTFR-2026-ALE-012, Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (12, 13 and 16 October 2026)
• Claroty Team82: Chilling Discoveries, unpacking vulnerabilities in Copeland XWEB Pro controllers (9 August 2026)
• Forescout Vedere Labs: Cold Chain, Open Control, exposed refrigeration systems reveal global risk (22 October 2026)
• Associated Press: Cyberattack hits French blood bank site but no blood products were compromised (4 November 2026), quoting the EFS statement
• Help Net Security: Cyberattack hits French blood banks (4 November 2026)
• ICI Bourgogne-Franche-Comté: Cyberattaque, des chambres froides de l’Établissement français du sang victimes d’un piratage informatique (4 November 2026)
• L’Essentiel de l’Éco: Piratage contre la banque de sang, l’ANSSI avait pourtant alerté, with the Coolworld notice and the 21 October Senate hearing (4 November 2026)
• Génération-NT: Cyberattaque des frigos de supermarchés, l’Anssi pointe des défauts de sécurisation élémentaires (October 2026)
• Help Net Security: Cyberattacks hit European grocers, French supermarket freezers hijacked (12 October 2026)
• CNBC: French supermarket fridges get hacked, heating to 122°F and sparking fires (13 October 2026)
• Al Jazeera: Very cold war, who’s attacking Europe’s supermarket freezers? (3 November 2026)
• Bloomberg via Insurance Journal: Supermarkets across Europe report new suspected freezer hack (2 November 2026)
• ITV News: UK meat processing firms hit amid fridge and freezer cyber attacks (3 November 2026)
• NPR: A new cold war, hackers target fridges across the globe (3 November 2026)
• Cybernews: Russian hackers claim responsibility for attacks on European refrigeration systems (4 November 2026)
• RetailDetail: Pro-Russian hackers claim attack on supermarket refrigerators, “systemic negligence” (5 November 2026)