Hackers heat cold rooms at French blood service sites, and a CISA alert follows

The Établissement français du sang, or EFS, runs blood collection and supply across France. It said that on November 2 the cold rooms at three of its sites were "raised to very high temperatures". The rooms held bags of plasma for transfusions, plasma used to make medicines, and samples kept for research.

Alarms went off, and staff acted quickly. Depending on the site, the equipment was either brought back under control or shut down, and the plasma was moved elsewhere as a precaution. The EFS says no health impact has been identified and no blood products were lost. Blood collection and deliveries to hospitals carried on as normal.

Not directly, according to the EFS. The attack hit one of its refrigeration suppliers, and from there reached the systems that monitor and control the supplier's cold rooms. The attackers raised the temperature and defrost settings to very high levels.

The EFS has not named the supplier. Coolworld Rentals, a European refrigeration company, confirmed that a cybersecurity incident involving remote monitoring software affected a limited number of its units. It says the attackers used a weakness in a component from a third-party supplier, outside its direct control.

The EFS has not given a number. An EFS official told Radio France's local network that readings reached 110°C and even 150°C, but that no samples were altered. Plasma is normally kept at around -25°C, so the gap is huge.

Nobody has claimed the attack. It is also not yet clear how many devices were hit. France's cybersecurity agency ANSSI and the Ministry of Health are working with the EFS, which has stepped up temperature monitoring across all its equipment.

The blood service incident is the latest in a series. It helps to know what is being attacked first. A refrigeration controller is a small computer that watches temperatures and runs defrost cycles. Many are connected to the internet so staff can check them from afar.

When one of these is left exposed with old software or a weak password, an attacker can change its settings from anywhere. The attack needs no clever trick. It only needs a controller that nobody updated.

• October 12 onward: an estimated 250 to 350 French supermarkets, including Intermarché, Carrefour Market, Monoprix, Leclerc and Super U, lost fresh and frozen food after controllers switched on defrost.
• August: about six commissaries and grocery stores on US military bases suffered similar incidents that spoiled food.
• November 2: a second wave hit more than 115 stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. In total, supermarkets in at least 11 European countries have been affected.
• November 2: the EFS cold rooms, through its supplier.

In real life Think of a freezer with a thermostat that anyone on the internet can turn. If the lock is the factory default, one person can warm up a thousand freezers before breakfast.

Many of the hacks stem from temperature controllers made by the Danish company Danfoss. Researchers say the attacks were not especially hard to pull off. The first French wave appears to have exploited unpatched controllers, including software versions that allegedly used weak passwords built from the date.

Danfoss has said the affected systems were running outdated firmware, which is the built-in software of a device, and urged customers to keep their products updated. Danfoss did not return a request for comment on the latest incidents.

The same weakness is in earlier warnings. In 2025, the US cybersecurity agency CISA disclosed flaws in Danfoss AK-SM 8xxA controllers, including one that allowed a login bypass. France's CERT-FR alert on October 12 named four product lines: Danfoss AK-SM and AK-SC, and Copeland and Dixell XWEB.

A Belgian refrigeration company, Sabcobel, said the November attackers used the same weakness as the October attacks.

In the second wave, some refrigeration systems were shut down entirely, while others had their temperature settings changed from afar. At one Swedish supermarket, the system reportedly began generating heat. Another store said its temperatures were changed to 50°C.

Pictures from across Europe show huge volumes of food being thrown away. The French supermarkets in October had the same result: the stores had to discard fresh and frozen products.

The 2025 CISA warnings covered two flaws in Danfoss AK-SM 8xxA controllers, tracked as CVE-2025-41450 and CVE-2025-41451. They could let an attacker skip the login and run commands remotely on a device that is not patched.

That is still unknown, and it may not be one group. Russian hacktivists, who say they hack for political reasons, tried to claim some of the attacks but gave no credible evidence. The Kremlin denied involvement this week.

Researchers see signs that Russia-based actors may have been involved in some cases, and possible ties to Iran-linked actors in others. Unnamed US officials suspect Iran-linked attackers may be behind the incidents at US military bases, though that investigation is ongoing. The Pentagon is looking into the incidents with French law enforcement.

This is not a new trick. In 2022, 16 supermarkets in Russia were attacked at the start of the war with Ukraine, and 40 stores in Israel were hit that year, according to a 2025 Danfoss report.

On Thursday, CISA issued an alert about the incidents. It says attackers could use flaws in cold storage systems, such as authentication bypasses (getting in without the right password), arbitrary code injection (running commands the owner never approved) and weak configurations.

Sweden's National Cyber Security Center noted that many businesses use older technology while their systems get more connected. Its advice is to make a list of every device connected to the internet, disconnect what you can, and keep the rest access-controlled, patched and monitored. The European Commission is reviewing retailers' defences.

"Our dependence on connected technology is growing faster than our collective will to protect it," said Josh Corman, a long-time critical infrastructure researcher at the Institute for Security and Technology. "These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons."

• Your blood supply was protected by alarms: the EFS caught the change because it had temperature alarms and staff on call.
• Food shopping may be disrupted: stores hit by these attacks threw away large amounts of chilled and frozen food.
• Businesses should check their fridges: if you run a shop, clinic or kitchen with connected cold storage, ask your supplier whether the controller is updated and whether it is open to the internet.
• Passwords still matter: a basic fix, like a strong password and a software update, stops many of these attacks.