Hackers reportedly changed temperature settings on refrigeration equipment used by the French Blood Establishment, EFS, from around −30°C to 110°C after targeting its cooling service provider, Coolworld. The incident occurred overnight between November 1 and 2, 2026, raising concerns about frozen plasma stored for patient transfusions.

According to reporting published by Cyberattaque citing Le Canard enchaîné, facilities in Bourgogne-Franche-Comté were among those concerned. France’s Health Ministry said staff detected the abnormal temperatures in time and that the incident caused no operational consequences.

Coolworld supplies temperature-controlled equipment and maintenance services, including refrigerated containers used in medical settings. An on-call technician reportedly noticed temperatures rising during the night, allowing teams to respond before the disruption affected operations.

Initial information concerned donor samples retained for blood safety monitoring. EFS later told Le Canard enchaîné that frozen plasma intended for transfusions was also involved. However, the available reports do not confirm destroyed plasma, disrupted transfusions, or harm to patients.

The number of affected units, the length of the disruption, and the temperatures actually reached inside stored products remain undisclosed. No public technical findings identify the attackers or explain how they entered Coolworld’s systems, Cyberattaque reported.

French Blood Plasma Freezers Hijacked

The reported 110°C figure describes a setpoint, meaning the temperature requested through a control system. It does not establish that freezer interiors, blood samples, or plasma bags reached that temperature. Controller settings, measured air temperatures, and temperatures inside stored products are separate readings.

This distinction matters because the risk depends on actual storage conditions and how long products remained outside approved limits. Reporting on the incident notes that fresh frozen plasma requires storage at −25°C or below. A prolonged temperature rise could make affected supplies unsuitable for transfusion.

Investigators have not publicly identified a controller model, exploited vulnerability, or stolen maintenance account. Claims that a specific Danfoss flaw caused this incident would therefore go beyond the available evidence.

The incident follows earlier attacks against supermarket refrigeration systems, where attackers reportedly changed settings to force continuous defrosting. Similar behavior does not prove that the same attackers, equipment, or entry method were involved at Coolworld.

An October 12 CERT-FR security alert confirmed numerous compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell XWEB systems. The agency warned operators against exposing management interfaces directly to the internet.

Cybersecurity News also documented internet-facing Danfoss systems, while noting that search results alone do not establish whether individual devices are vulnerable or compromised. No public evidence connects those exposed systems to the EFS incident.

CERT-FR recommends removing public internet access, reviewing full device configurations, checking defrost schedules, and restoring remote access only through secure VPNs or protected networks. Supported equipment should receive firmware updates, default passwords must be changed, and applicable security settings should be enabled.

For healthcare providers, the reported incident highlights risks extending beyond stolen records. A supplier compromise can affect equipment that preserves essential medical products.

Independent temperature monitoring and prompt staff response were important safeguards here, although the full technical cause remains unknown. Available reporting contains no confirmed theft of donor information.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hijacked French Blood Plasma Freezers, Changing Temperature Settings From −30°C to 110°C appeared first on Cyber Security News.