On November 2, 2026, commercial refrigeration systems at three sites of the French Blood Establishment (EFS) were hit by a cyberattack, and their temperature and defrost settings were changed without authorization. According to BleepingComputer's report, which cited an EFS statement dated November 3, the organization avoided losing any blood products because its monitoring and alarm systems detected the anomaly, staff took action on the equipment, and the necessary plasma was moved elsewhere. The targets were not household refrigerators but equipment used to store medical blood products. The incident shows that the attack altered refrigeration settings while the stored products were protected. It also shows the need to think separately about security measures that keep intruders out of equipment and safety measures that protect products after a breach.
Settings altered at three sites; plasma protected through transfers and other measures
The attackers changed the temperature and defrost settings of the systems that monitor and control the cold rooms. According to BleepingComputer and the refrigeration and air-conditioning trade magazine La Rpf, both citing the EFS statement, these settings were changed to abnormally high values. However, a higher temperature setpoint does not necessarily mean the actual temperature inside the units rose to the same level. How high the internal temperatures actually climbed, and for how long storage conditions were breached, has not been disclosed.
According to the EFS, its monitoring and alarm systems quickly detected the anomaly, and measures were taken to prevent further damage. The affected equipment was brought back under control or disabled, and stored products were preventively moved to other equipment as needed. The products included plasma for transfusion and plasma used to manufacture medicines, and the EFS says both were secured through transfers and other measures. As a result, the EFS said, no health impact was identified and no blood products were lost. Blood collection and supply also continued, and a serious disruption to the supply of medical blood products was avoided.
What matters here is distinguishing between intrusion into the equipment and harm to the stored products. That no blood products were lost does not mean unauthorized access to the refrigeration systems was prevented. Conversely, the fact that temperature and defrost settings were changed does not by itself mean the stored plasma became unusable. What the EFS explanation confirms is a sequence of events: after the anomaly was detected, action was taken on the equipment and products were moved, and blood product losses were avoided as a result.
Why can a remote management system change refrigeration temperature settings?
Systems that centrally manage commercial refrigeration equipment are not merely monitoring devices. In a research report published on August 9, 2026, Team82, the research group at security company Claroty, used Danfoss's centralized management unit AK-SM 800A as an example to explain how such a system collects information from multiple refrigeration controllers and manages them together. Administrators can set temperature thresholds and alarms through a web-based interface, and can also manage operating schedules, notifications, and user access permissions. These functions make it possible to monitor and maintain many refrigeration units remotely.
However, if attackers abuse remote management functions, features meant to keep equipment running safely can become a way to alter storage conditions without authorization. If an attacker takes over access to a management system, they may be able to use legitimate settings to change temperature and defrost conditions. In other words, ensuring the safety of refrigeration equipment requires protecting not only the cooling hardware itself but also the management systems that tell it how to operate.
Team82 reported vulnerabilities in the AK-SM 800A, including a flaw that allows authentication to be bypassed and one that allows unauthorized commands to be executed after authentication. It also describes firmware version "R4.3.1", which includes fixes, but these findings do not directly explain the method used in the EFS attack. According to The Record's report, the outlet asked an EFS spokesperson for the manufacturer and model of the targeted control equipment but received no reply. It therefore remains unconfirmed whether the equipment used by the EFS was made by Danfoss, or whether the vulnerabilities reported by Team82 were exploited.
Meanwhile, refrigeration equipment rental company Coolworld said in its own announcement on November 4 that a cybersecurity incident had occurred involving remote monitoring software. The company explained that the vulnerability cited in media reports relates to a component supplied by a third party. It said the affected equipment was limited but declined to comment on individual cases. Because the EFS has not named the contractor involved, it is not possible to determine whether Coolworld was involved in this incident or who made the component in question.
Thus, while the technical mechanism by which refrigeration settings can be changed through a remote management system can be explained, the intrusion route actually used in the EFS attack has not been disclosed. The existence of a known vulnerability, and the fact that its disclosure came close in time to the incident, is not in itself evidence that the vulnerability was used in the attack.
Protecting plasma and preventing re-intrusion require different measures
Before the attack on the EFS, on October 12, France's computer emergency response team, CERT-FR, issued a warning about compromises of control equipment for commercial refrigeration systems, and updated it by the 16th. The products listed were Copeland's xweb, Danfoss's AK-SC and AK-SM, and Dixell's xweb. The warning does not identify the models used by the EFS, but it sets out concrete measures for operating commercial refrigeration equipment safely.
CERT-FR places particular emphasis on not exposing management interfaces directly to the internet. It calls for eliminating configurations in which management interfaces can be reached directly from outside, including on equipment with no confirmed compromise, and for using protected networks such as VPNs for remote connections. It positions restricting access by source IP address as a temporary emergency measure.
It also recommends checking all settings, including defrost time windows and not just temperature settings, and updating firmware. On supported models, the "Strict" setting should be enabled and default passwords changed. For equipment that has already been compromised, the first step is to stop exposing the management interface to the internet and, for Danfoss equipment, try rebooting. If that does not restore normal operation, the device should be reset to factory settings, reconfigured and updated, and made reachable only through protected paths such as a VPN. However, even if a reset gets the device working normally again, the risk of re-intrusion remains if it is exposed to the internet again without the vulnerabilities being fixed.
Putting the EFS response and the CERT-FR advisory side by side shows that defending against cyberattacks involves several stages with different purposes. Protecting management interfaces and updating firmware reduce the routes an attacker can use to get in, while checking settings and recovering are about returning equipment to a normal state. The monitoring, alarms, and plasma transfers carried out by the EFS, by contrast, are measures that protect stored products after equipment has been compromised. The table below organizes these responses by purpose, based on the CERT-FR warning and the BleepingComputer and La Rpf reports citing the EFS statement.
| Purpose | Published measures | What is confirmed in the EFS incident | Operational points to check |
|---|---|---|---|
| Reduce intrusion routes | Stop exposing management interfaces externally, limit access to protected paths such as VPNs, update firmware | Intrusion route and status of individual countermeasures not confirmed | Whether anything is exposed externally, remote maintenance connection paths, who is responsible for updates and authentication management |
| Restore normal settings | Check all settings and defrost time windows; reset, reconfigure and update as needed | EFS says it brought equipment back under control or disabled it | Settings checks after recovery, update status, procedures to prevent unpatched equipment from being re-exposed |
| Protect stored products | Anomaly detection through monitoring and alarms, action on equipment, preventive transfer of necessary products | No blood products lost. However, the monitoring system configuration and the time available to respond were not disclosed | Who controls equipment after an alarm, criteria for deciding on transfers, securing destinations for transfers |
This table organizes the purpose of each measure and does not compare their success rates or the safety of the equipment. Even though the EFS avoided losing blood products, that alone does not mean the intrusion route has been blocked or the vulnerabilities fixed. The mechanisms that keep intruders out of equipment, the procedures for restoring compromised equipment, and the response that protects stored products each need to be verified from a different perspective.
It also remains unclear whether the EFS monitoring system was installed on a network independent of the control systems, or how much time there was between an alarm and the transfer of plasma. CERT-FR advises checking data transmission to maintenance contractors and insurance policy conditions when cutting network connections. This is because a security decision to cut off external communications can affect equipment maintenance and on-site operations. It is therefore important to align the procedures for blocking intrusion routes with those for keeping refrigeration equipment running and stored products safe.
The incident showed that even when medical refrigeration equipment is hit by a cyberattack, rapid anomaly detection and action on site can prevent the loss of stored products. At the same time, because details of the intrusion route and the targeted equipment have not been disclosed, it is impossible to judge whether the measures in place were sufficient to prevent a similar attack. Going forward, it will be necessary not only to check whether management interfaces are exposed and whether updates have been applied, but also to define who receives alarms, who controls the equipment, and what criteria are used to decide on plasma transfers. Linking cybersecurity measures with on-site storage and transfer procedures is key to protecting the stable supply of medical blood products.