French blood-service refrigeration controls compromised at three sites; safeguards prevent losses

November 2 incident reached three blood-service sites

A cybersecurity incident affected refrigeration equipment at three sites operated by France’s blood service, EFS, on November 2. EFS confirmed the date to The Connexion and the three-site scope to The Record. Its public statement, issued November 3 according to The Record, described altered temperature and defrosting thresholds. This is an incident disclosed and developed publicly on November 3–4, not a newly occurring November 5 attack. [3][4]

The affected cold rooms held plasma intended for transfusion and pharmaceutical manufacture, as well as blood samples. EFS reported no lost blood products or identified health consequences, and collection and distribution continued. The development therefore establishes interference with healthcare cold storage, but not destroyed supplies or patient harm. Those distinctions are central to assessing its significance without overstating the outcome. [1][5]

Independent monitoring preserved a way to detect trouble

In a November 4 RTL interview, EFS deputy director Sophie Le Cam credited independent temperature-supervision systems with detecting abnormalities quickly enough for staff to act. Personnel intervened, disconnected affected equipment where necessary and secured or transferred its contents. In EFS’s account, interference with refrigeration controls did not disable the separate means of detecting unsafe changes. The protective response combined monitoring with staff able to intervene. [5]

The defensive inference is that preventing an intrusion and preventing its physical consequences are different tasks. EFS’s reported experience supports maintaining independent alarms and workable storage contingencies even when refrigeration is remotely managed. It does not establish that all equipment remained unaffected or that recovery was complete: investigators were still determining the equipment scope and timetable for secure restoration. [5]

The supplier account does not establish the intrusion chain

EFS described the incident as reaching its facilities through a refrigeration provider rather than through an attack directly targeting EFS itself. That is the organization’s account, not a published forensic reconstruction. The EFS spokesperson contacted by The Record could not identify the controller manufacturers or models at the affected sites, leaving a major gap for anyone trying to determine whether their own equipment shares the exposure. [4]

Coolworld separately acknowledged on November 4 an incident involving refrigeration remote-monitoring software and said a limited number of its units were affected. It attributed the reported vulnerability to a third-party component outside its direct control, but identified no component, affected versions, CVE or individual customers. Its acknowledgment adds supplier-side evidence of an incident; its explanation of responsibility remains a claim without published technical substantiation. [6]

The reported 110°C setting is not a measured blood temperature

The widely repeated 110°C figure originated in reporting attributed to Le Canard enchaîné. When The Connexion asked EFS about it, the press office said it had not communicated exact temperature figures and could not confirm them. That leaves the precise reported setting unverified by EFS. It is not evidence that plasma, samples or the cold rooms themselves reached that temperature. [3]

The Register also distinguishes a reported controller setting from temperatures actually reached by equipment or contents. Read alongside EFS’s account of successful intervention and no product losses, the sources support describing altered controls and an effective protective response. They do not support claims that blood was boiled or stocks destroyed. EFS’s inability to confirm a figure should not be presented as confirmation or a definitive denial. [11][1][5][3]

Separate reporting strengthens confirmation, not forensic certainty

The evidence includes several distinct reporting contributions. The Record obtained direct confirmation of the three affected sites; The Connexion directly checked the incident date and temperature claim; RTL interviewed a named EFS executive about safeguards. Associated Press separately reported the no-loss outcome and included the supplier response. These are separate reporting efforts, but the operational outcome still largely rests on EFS’s account rather than an independent technical audit. [4][3][5][1]

Repeated publication of the 110°C figure is different: those reports trace back to the same attributed claim, so repetition does not provide independent confirmation. CERT-FR’s official advisory and Coolworld’s company statement are primary sources, but answer narrower questions. The advisory establishes broader refrigeration-security guidance, while the statement records the supplier’s position. Neither identifies the precise EFS exploitation chain. [3][2][6]

Operators should verify controls, not just restore access

CERT-FR’s refrigeration warning was published and updated during October 12–16, not newly issued in November. It recommends removing direct internet exposure of management interfaces and restoring remote access only through a secured VPN or protected network. Operators should verify actual configurations, especially defrost schedules, and follow manufacturer-specific hardening guidance, including firmware updates and replacement of default passwords. [2]

The advisory names Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB systems, but does not establish that any of them were installed at EFS. Product-specific measures must therefore follow an equipment inventory, not an assumed match to this incident. For XWEB EVO operators specifically, vendor guidance recommends migration because the product has reached end of service and no longer receives security fixes. [2][7]

An additional editorial recommendation drawn from EFS’s reported response is to test independent alarms and contingency storage arrangements. Monitoring should not depend entirely on the controls it monitors. Security changes should be coordinated with refrigeration operators so cooling and monitoring remain available; restored connectivity alone is not evidence that temperature thresholds and defrost settings are safe. [5][2]

Watch for recovery evidence and a defined technical scope

The next useful disclosures would identify the affected component, controller models, software or firmware versions, and the method of access. Investigators were also still determining the total equipment scope and secure-restoration timetable. Three affected sites should not be converted into an assumed count of refrigerators, controllers or blood units. Containment and continued service are important outcomes, but do not establish completed recovery. [4][5][6]

Links to other refrigeration attacks also remain unresolved. The Record describes disruption across several European countries without establishing common perpetrators, while The Register says a shared access route between EFS and supermarket incidents remains unclear. The supported framing is a healthcare incident amid wider refrigeration attacks. A single coordinated campaign against food and blood supplies would require evidence these sources do not provide. [4][11]