Blood service breach chills cold chain

Cold storage rooms holding blood samples and plasma are supposed to sit at around -30°C. Overnight between November 1 and 2, according to French investigative weekly Le Canard enchaîné, unauthorized actors took control of refrigeration controllers inside France's National Blood Service (EFS) and drove some reports of room temperature as high as 110°C — a figure that describes what the controllers displayed, not what the air in the rooms actually reached.

The incident, reported on November 3 and attributed by the newspaper to attacks on temperature-controlled storage and refrigeration equipment provider Coolworld, is the latest in a series of attacks on refrigeration control systems in France and across Europe. The affected EFS facilities were concentrated in the Burgundy and Franche-Comté region of east-central France.

What the cold rooms hold

EFS cold storage units are not general-purpose refrigerators. According to Le Canard enchaîné, they host blood samples used for health monitoring as well as plasma intended for transfusions. Those materials are typically kept at -30°C (-22°F).

The newspaper reported that some rooms were hit with readings of up to 110°C (230°F). That number is a controller reading, and the reporting is explicit that it does not mean the equipment or any blood samples reached those temperatures. What it does indicate is that the systems responsible for holding a controlled cold environment were being instructed to do something else.

The refrigeration control systems in the affected EFS cold rooms are maintained by Coolworld, a Dutch temperature control rental company that operates in France, Germany, Ireland, the Netherlands and the UK. The incident therefore sits at the intersection of a national blood service and an external supplier of temperature-controlled equipment and its monitoring software.

Coolworld confirms remote software incident

Coolworld confirmed on November 4 that it was "aware of the cybersecurity incident involving remote monitoring software used in refrigeration systems" and said it "responded promptly by implementing the appropriate measures." The company did not share details of those measures.

Coolworld also stated that only a limited number of its units were affected, and that "the vulnerability currently being reported in the media concerns a component supplied by a third-party provider and not directly controlled by Coolworld."

"the vulnerability currently being reported in the media concerns a component supplied by a third-party provider and not directly controlled by Coolworld."

— Coolworld, in a November 4 statement

Technician spots the anomaly

The French Ministry of Health told Le Canard enchaîné that the incident caused no operational disruption because it had been detected in time. According to the EFS, an on-call technician noticed an abnormal rise in temperature in the cold storage rooms overnight, allowing the issue to be identified before it could affect operations.

Speaking to French national news channel BFMTV, EFS president Frédéric Pacoud said that while the EFS "could have lost samples or bags of plasma intended to treat patients," the early warning meant "there was no compromise to the safety of blood products."

"could have lost samples or bags of plasma intended to treat patients"

— Frédéric Pacoud, president of the EFS, speaking to BFMTV

The EFS also told French media it notified the country's national cybersecurity agency (ANSSI). At this stage, nothing indicates that any EFS IT systems are impacted by the attack.

Key figures from the EFS incident

• 110°C (230°F) — the highest temperature reading reported in some affected cold rooms, versus a normal holding temperature of -30°C (-22°F)
• November 1–2 — the overnight window during which unauthorized actors took control of refrigeration controllers
• November 3 — the date Le Canard enchaîné reported the new wave of attacks on refrigeration systems in France
• November 4 — the date Coolworld confirmed it was aware of the incident involving remote monitoring software

A wider wave across Europe

The EFS incident follows earlier reporting on attacks against refrigeration control systems. As Infosecurity Magazine has covered, major French supermarket chains were hit by a cyber-attack that impacted food stock, and a subsequent report found that the same campaign affected more refrigeration controllers. Coverage also described a cyber-attack on refrigeration systems hitting supermarkets across Europe.

Those earlier incidents concerned retail food storage. The EFS case extends the same category of target — temperature-controlled storage managed through remote monitoring and control software — into a blood service setting, where the stored material is plasma for transfusions and blood samples for health monitoring.

Supplier-scoped response

Coolworld's confirmation is limited in scope. The company described the issue as involving remote monitoring software used in refrigeration systems, said it responded promptly with measures it did not detail, and placed the vulnerability with a component from a third-party provider that it says it does not directly control. It did not say which provider, what the component does, or whether other customers beyond EFS were affected.

The EFS, for its part, described the detection sequence and confirmed it had contacted ANSSI. The agency's involvement is noted in the EFS's statements to French media, but no findings from ANSSI have been disclosed. The EFS was approached for comment and had not responded at the time of publication.

What the temperature reading means

The 110°C figure is best read as evidence of control, not of physical heat. A refrigeration controller that is manipulated to report or target an extreme setpoint has been reached by whoever is sending it instructions. The reporting does not describe how the actors accessed the controllers, whether credentials were reused, or what the remote monitoring software's role was in the chain.

What the source material does establish is the physical setting: cold rooms in the Burgundy and Franche-Comté region, blood samples and plasma normally held at -30°C, a supplier in Coolworld maintaining the refrigeration control systems, and an overnight anomaly that an on-call technician observed.

Why this matters beyond the blood bank

The EFS incident shows how far a refrigeration control attack can reach beyond grocery stock. Blood samples used for health monitoring and plasma intended for transfusions depend on equipment that is rented, maintained and remotely monitored by outside suppliers — and Coolworld's statement places the reported vulnerability in a component supplied by a third party rather than one it directly controls. For operators of any temperature-dependent service, this suggests the security of the cold chain may depend on visibility into suppliers' software and their suppliers in turn.

The detection here came from a person watching the readings overnight, according to the EFS. That raises a practical question for other operators: whether their own monitoring would surface an abnormal setpoint change with the same speed, especially outside business hours. The ministry's position that no operational disruption occurred rests on that early detection, and the EFS president's comments point to what was at stake — plasma intended for patients. This suggests that for critical storage, the margin between a scare and lost medical material may depend on how quickly an anomaly is noticed and who is responsible for noticing it.