A freezer is not usually a cybersecurity story. This week it was.
On November 2, temperature and defrost thresholds were raised "to extremely high levels" at three cold-storage sites of the French Blood Establishment (EFS), according to its statement reported by the Associated Press. The sites store plasma for transfusions and for making medicines. The EFS said it was not directly targeted: the attack hit a supplier of refrigeration equipment whose solution ran the controllers.
What happened
- At the EFS: an on-call technician noticed an abnormal temperature rise overnight, and monitoring and alarm systems flagged the anomaly. Products were transferred or secured. The EFS said no products were lost.
- At supermarkets: the same week, supermarkets in several European countries reported fridges and freezers warming after being remotely taken over, with large losses of food. Reports describe a mid-October episode that hit hundreds of supermarkets and independent stores across France, Belgium, and the Netherlands.
- The scale of the attempt: French weekly Le Canard Enchaîné, which first reported the blood-bank attack, said settings that are normally around −30 °C were pushed toward as high as 110 °C, as relayed by AP and CBS.
The equipment provider named in reports, Coolworld, said the vulnerability being reported related to a component from a third-party supplier outside its direct control, and that a limited number of units were affected. A threat-intelligence firm, Lupovis, said it had seen login attempts aimed at a type of refrigeration controller since October 20. As far as we could find, the root cause has not been officially established.
Why this works: the supplier is the weak link
Many facilities do not run their own refrigeration controls. A vendor remotely manages controllers across hundreds of sites. If an attacker gets into that vendor's access, one compromise reaches every customer at once. This is the same logic as a poisoned software update: attack the trusted middleman.
It also shows why physical systems are different from stolen data. Nothing needs to be encrypted or leaked. Changing a number on a controller is enough to spoil stock.
What prevented a worse outcome
The EFS cold rooms had monitoring and alarms, and a person who responded. That is the part to copy:
- Independent alarms. Temperature alarms that use their own sensors and notification path still work when the control system is compromised.
- Hard limits. Where possible, set limits in hardware that remote commands cannot override.
- A human on call. An alert only helps if someone is responsible for acting on it.
What facility and IT teams can do
- Do not expose controller admin interfaces to the internet. Put remote access behind a VPN with multi-factor authentication.
- Replace default and shared passwords, and give each vendor technician a separate account.
- Ask suppliers how remote access is secured, logged, and revoked.
- Keep a manual fallback: spare cold storage, and a plan to move stock.
What everyone else can do
Your home fridge is not the target here. But the basics apply to any connected device: change default passwords, install firmware updates, and keep device admin pages off the open internet.
Sources
- Cyberattack disrupts blood storage refrigeration systems in France (BleepingComputer)
- Cyberattack hits French blood banks (Help Net Security)
- Blood banks hit by cyberattack in France days after European freezer hacks (CBS News)
Reported as of November 5, 2026. Details may change as investigations continue.