What just happened? Refrigeration facilities at the Établissement Français du Sang (EFS), France’s national blood donation service, were hit by a cyberattack. It is the latest in a series of break-ins targeting cold storage inspectors across Europe. No blood products or other biological materials were lost. The attack triggered EFS’s alarm system, prompting employees to move the affected inventory to functioning storage units before it could spoil.
The French Health Ministry said it was closely monitoring the situation and confirmed that no biological materials had been lost. The break-in apparently targeted refrigerators at three locations, including reportedly one in Burgundy-Franche-Comté.
The attackers did not directly breach EFS. The agency says the break-in occurred at one of its service providers, which several branches have identified as Coolworld, a refrigeration rental company. Coolworld released a statement attributing the incident to the “remote monitoring software” used in its systems. The issue was attributed to “a third-party component,” but no further technical details were released.
Without these details, it is difficult to determine how the attackers gained access. In the previous attacks on supermarkets, they targeted refrigerators that were directly connected to the internet. Instead, Coolworld could keep its controllers on a private network, which would have required attackers to break into that network first. One detail stands out in each case: EFS’s monitoring and alarm system detected the violation, not the provider’s.
Coolworld has not revealed which brand of controller it uses. The attacks so far have apparently targeted devices from one manufacturer. Danfoss controls played a particularly prominent role in the attacks at the beginning of November, although they were not the only devices involved.
Copeland’s Dixell controllers were also the target of the attacks in mid-October. During the second wave of supermarket attacks, intruders in Belgium and Sweden raised freezing temperatures to 50 degrees Celsius, destroying food supplies.
The manufacturers’ documentation explains how the devices became accessible to attackers. A Danfoss data sheet states that its controllers should be installed behind “appropriately configured firewalls and a secure LAN” and not connected to “a public or non-secure network.”
This formulation leaves considerable room for interpretation. An installer who opens firewall ports to allow remote access can leave a device almost as unprotected as a device connected directly to the Internet. Danfoss has since issued a support bulletin specifically instructing customers to install the devices behind a VPN. The bulletin was not published until October 2026 and searches did not turn up an earlier version of this advisory.
Copeland’s guidelines were even less restrictive. In the installation manuals for the Dixell monitoring controllers, a VPN is only mentioned as an option. Copeland changed its guidance on October 14 after the first wave of attacks, when it published a security advisory saying that the controllers should only be accessible via a VPN.
Two Russian-allied hacker groups, Noname057(16) and Z-Pentest, have claimed responsibility for the attacks. Multiple news outlets reported seeing the claims in Telegram posts that have since been deleted. Z-Pentest has reportedly released 2,500 lines of Danfoss code, although none of it has been made publicly available. The groups say their goal is to expose bad cybersecurity practices.
