### French Blood Service Caught in Supply Chain Attack On November 2, a cyberattack on a refrigeration equipment provider led to elevated temperature and defrost settings at three **EFS** facilities. The **EFS**, responsible for blood collection, processing, and distribution across France, stated that its systems for monitoring cold-storage chambers were affected. Crucially, **EFS** clarified that it was not the direct target of the attack. Instead, the incident originated with one of its refrigeration suppliers. While **EFS** has not publicly named the vendor, European refrigeration equipment provider **Coolworld Rentals** confirmed a cybersecurity incident involving its remote monitoring software, affecting a limited number of its units. ### Third-Party Vulnerability Exploited **Coolworld Rentals** indicated that attackers exploited a vulnerability in a third-party component, which was outside the company's direct control. "The vulnerability currently being reported in the media relates to a component from a third-party supplier and was outside Coolworld's direct control," the company stated. They confirmed prompt action and mitigation measures. ### Rapid Response Prevents Product Loss At the affected **EFS** facilities, the attack caused temperature and defrost thresholds in cold-storage chambers to rise significantly. These chambers house vital blood products awaiting distribution to hospitals, as well as biological samples. Fortunately, **EFS**'s monitoring and alarm systems quickly detected the abnormal temperature changes. Staff were able to either rectify the impacted equipment or transfer products to alternative refrigeration facilities. "No health impact has been identified, and no loss of blood products has been reported," **EFS** confirmed in its statement. Plasma bags designated for transfusions and plasma used for medicine manufacturing were secured, preventing damage. Blood collection and distribution operations have continued without interruption. **EFS** is collaborating with France's national cybersecurity agency (**ANSSI**) and the Ministry of Health, and has enhanced its monitoring of refrigeration equipment and temperatures. ### A Broader Trend of Refrigeration System Attacks This incident is not isolated. It aligns with a recent surge of cyberattacks targeting refrigeration systems across Europe. Attackers have been remotely manipulating temperature settings or activating defrost functions, effectively disabling cooling mechanisms. In October, similar cyberattacks disrupted refrigeration systems at an estimated 250 to 350 French supermarkets, including major retailers like **Intermarché**, **Carrefour Market**, **Monoprix**, **Leclerc**, and **Super U**. These attacks reportedly compromised refrigeration controllers running older **Danfoss** software, activating automatic defrosting and forcing stores to discard perishable goods. These attacks specifically targeted **Danfoss AK-SM/AK-SC** and **Copeland/Dixell XWEB** refrigeration controllers, commonly used for remote monitoring and management of cooling equipment. ### Expanding Scope of Attacks A second wave of these attacks occurred this month, impacting over 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Some systems were completely shut down, while others had their temperature settings altered remotely. Reports from Sweden indicated one system began generating heat, and another had temperatures changed to 50°C (122°F). Belgian refrigeration company **Sabcobel** suggested that the attackers behind the November incidents exploited the same vulnerability used in the October attacks against French supermarkets. In 2025, the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** disclosed two vulnerabilities, **CVE-2025-41450** and **CVE-2025-41451**, affecting **Danfoss AK-SM 8xxA** controllers. These flaws could permit attackers to bypass authentication and execute remote commands, potentially granting full control over refrigeration equipment. However, it remains unconfirmed whether these specific vulnerabilities are being exploited in the ongoing attacks.