What just happened? Refrigeration units operated by Établissement Français du Sang (EFS), France's national blood service, have been hit by a cyberattack. It is the latest in a series of intrusions targeting cold-storage controllers across Europe. No blood products or other biological materials were lost. The attack triggered EFS's alarm system, prompting staff to move the affected stock to functioning storage units before it could spoil.
The French Health Ministry said it is closely monitoring the situation and confirmed that no biological materials were lost. The intrusion appears to have targeted refrigeration equipment at three sites, reportedly including one in Burgundy-Franche-Comté.
The attackers did not breach EFS directly. The agency says the intrusion occurred at one of its service providers, which several outlets have identified as Coolworld, a refrigeration rental company. Coolworld has published a notice attributing the incident to "remote monitoring software" used in its systems. It traced the problem to "a component from a third-party supplier," but has released no further technical details.
Without those details, it is difficult to determine how the attackers gained access. In the earlier supermarket attacks, they targeted refrigeration equipment that was directly exposed to the internet. Coolworld may instead keep its controllers on a private network, which would have required the attackers to breach that network first. One detail stands out either way: EFS's monitoring and alarm system detected the breach, not the vendor's.
Coolworld has not disclosed which brand of controller it uses. The attacks so far appear to have targeted one manufacturer's equipment at a time. Danfoss controllers have featured most prominently, particularly in the attacks at the beginning of November, although they were not the only devices involved.
Copeland's Dixell controllers were also targeted in the attacks in mid-October. During the second wave of supermarket attacks, intruders raised freezer temperatures in Belgium and Sweden to 50 degrees Celsius, destroying food stocks.
The manufacturers' own documentation helps explain how the devices became accessible to attackers. A Danfoss datasheet says its controllers should be installed behind "appropriately configured firewalls and secure LAN" and should not be connected to "any public or non-secure network."
That wording leaves considerable room for interpretation. An installer who opens firewall ports to enable remote access can leave a device almost as exposed as one connected directly to the internet. Danfoss has since issued a support bulletin explicitly instructing customers to install the units behind a VPN. The bulletin appeared only in October 2026, and searches turned up no earlier version of this recommendation.
Copeland's guidance was even less restrictive. Installation manuals for its Dixell XWEB supervisory controllers instruct installers to forward port 80 (the web interface) and port 22 (Secure Shell) to the internet so the units can be accessed remotely. A VPN is mentioned only as an option. Copeland changed its guidance on October 14, following the first wave of attacks, when it published a security advisory stating that the controllers should only be accessible through a VPN.
Two Russia-aligned hacking groups, Noname057(16) and Z-Pentest, have claimed responsibility for the attacks. Several news outlets report having seen the claims in Telegram posts that have since been deleted. Z-Pentest reportedly published 2,500 lines of Danfoss code, although none of that material has been made publicly available. The groups say their goal is to expose poor cybersecurity practices.