The Établissement Français du Sang (EFS) confirmed in a press release dated 3 November 2026 that one of its refrigeration equipment providers suffered a cybersecurity incident on 2 November 2026. The provider’s supervision and control systems for cold rooms at three EFS sites were affected. This EFS blood freezer attack was not aimed directly at the EFS, according to the EFS.
The EFS says the temperature and defrost thresholds of the affected cold rooms were raised to very high temperatures. It gives no figures. A threshold is the target given to a controller, not a measured product temperature.
- Incident dateYes2 November 2026, at a refrigeration equipment provider3 Nov 2026
- Sites affectedYesCold-room supervision and control at three EFS sites3 Nov 2026
- Change madeYesTemperature and defrost thresholds raised to very high temperatures3 Nov 2026
- Product lossNot seenNo health impact identified and no loss of blood products to declare3 Nov 2026
- Cause and entry routeUnknownThe release does not say how the provider was compromised3 Nov 2026
What Did the EFS Do About It?
The EFS says its own monitoring and alarm systems identified the anomalies quickly. The equipment was brought under control or neutralised, and products were moved to other installations as a precaution.
The affected equipment held plasma bags for transfusion and for making medicines. The EFS says these were transferred or secured, and that collection and distribution continue. Its teams are working with the national cybersecurity agency ANSSI and the Ministry of Health, and it has reinforced temperature monitoring of all its equipment.
What Does CERT-FR Say About Refrigeration Controllers?
CERT-FR, the French government response team, published alert CERTFR-2026-ALE-012 on 12 October 2026 and last updated it on 16 October 2026. It concerns many compromises of remote controllers: Copeland xweb, Dixell xweb, Danfoss AK-SC and Danfoss AK-SM.
The alert does not mention the EFS, and the EFS release names no product, so we do not link the two. CERT-FR says that exposing a management interface to the Internet goes against good practice, and that attacks on these devices are likely still ongoing. For the earlier wave, see our supermarket refrigeration attack playbook.
What Should Operators Do After an EFS Blood Freezer Attack?
- List every freezer, refrigeration and environment controller that has a network path, including those a service provider installed.
- Remove direct Internet exposure and restore access only through a secure VPN or a protected network, as CERT-FR recommends. CERT-FR also advises checking insurance conditions before cutting the data link to your refrigeration contractor.
- Review the full controller configuration, including defrost schedules, and record the normal thresholds so a change stands out.
- Add a temperature probe and alarm that do not depend on the controller, with a message to an on-call person when temperature rises or a threshold changes.
- Review the provider’s remote access: named accounts, multi-factor authentication, time-limited sessions and logs you can read.
- Rehearse a manual fallback: where products move, who decides and how fast.
Step 2 and the configuration review in step 3 follow CERT-FR’s recommendations for refrigeration controllers. Recording normal thresholds and steps 1, 4, 5 and 6 are our advice and do not assume how the provider was compromised.
Why Does a Provider’s Remote Access Matter Here?
A service provider that can change thresholds from outside holds the same power over your cold chain as an attacker who steals its access. That is why the provider’s access needs the same controls as your own. Our External Remote Services technique page and the guide on responding to a supplier’s new exposure signal cover the wider pattern.
What Is Still Open?
The EFS release does not give the temperatures reached, how long the thresholds stayed raised, the provider’s name or how the provider was compromised. We add none of these. We will update this post if the EFS, ANSSI or CERT-FR publishes more.