Cyberattack disrupts blood storage refrigeration systems in France

What it is

On 2 November 2026 an attack on a refrigeration supplier raised temperature and defrost thresholds to extremely high levels in cold-storage chambers at three French Blood Establishment (EFS) facilities. EFS said it was not the direct target. The chambers hold blood products awaiting distribution to hospitals, plus biological samples. EFS reported no health impact and no lost blood products. Plasma bags for transfusion and for medicine manufacture were moved or secured, and collection and distribution continued.

How it works

Attackers remotely change refrigeration controller settings: thresholds raised, or automatic defrost triggered, which switches cooling off. Coolworld Rentals says the entry point was a vulnerability in a third-party component of its remote monitoring software, outside its direct control, and that only a limited number of units were affected. EFS did not name the supplier.

The same technique has hit retail:

• October 2026: an estimated 250 to 350 French supermarkets (Intermarché, Carrefour Market, Monoprix, Leclerc, Super U). Controllers running older Danfoss software were reportedly compromised and defrost was activated, so stores discarded fresh and frozen stock.
• November 2026: more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Some systems were shut down, one Swedish store's system reportedly produced heat, and another store saw 50°C (122°F) set.

Belgian firm Sabcobel said the November attackers used the same vulnerability as the October attacks.

Preconditions / Affected

Targeted devices are Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB controllers, which are managed remotely. CISA's 2025 disclosures CVE-2025-41450 and CVE-2025-41451 cover Danfoss AK-SM 8xxA controllers. They allow authentication bypass and remote command execution, which would give control of the refrigeration equipment. The page gives no affected version ranges or fixed versions.

What to do

The page states no patch or configuration guidance. The only response it describes is EFS's: alarms caught the change quickly, staff repaired equipment or moved product to other refrigeration, and EFS has strengthened monitoring of refrigeration equipment and temperatures. It is working with ANSSI and the Ministry of Health. Operators of these controllers can check whether they run the Danfoss AK-SM 8xxA units named in the CISA advisories.

Caveats

The page says it is not confirmed that CVE-2025-41450 or CVE-2025-41451 are being exploited. It does not tie the Coolworld component to a CVE or to Danfoss or Copeland. It does not say how the attackers reached the controllers, so internet exposure of the management interfaces is not established.