Executive Summary
The EFS cyberattack hit cold-storage equipment at three sites of the Établissement français du sang (EFS), France’s national blood service, overnight into Monday 2 November 2026. Attackers reached the remote supervision system run by a refrigeration supplier and raised temperature and defrost thresholds to very high levels, EFS said on 3 November. Alarms caught the change in time. EFS says no blood products or samples were lost and the plasma bags were moved or secured. Coolworld, named in press reports as the supplier, says the flaw sits in a component made by another company. EFS is working with France’s cybersecurity agency ANSSI and the Health Ministry. The same night, freezers at ICA and Coop stores in Sweden were also disrupted.
Plasma for Transfusions Sat in the Affected Cold Rooms
The EFS cyberattack reached units holding plasma bags meant for transfusion and plasma bound for fractionation into medicines, according to the EFS statement. Monitoring flagged the rising thresholds and staff stepped in before any product was lost. Blood collection and distribution carried on without interruption. EFS says it has since stepped up monitoring of all its equipment.
How far the settings were pushed is less clear. A published report put the new setpoint at 110°C for chambers normally kept at minus 30°C.
EFS gave no figure for the temperature actually reached.
Coolworld Points to a Third-Party Component
Coolworld said on 4 November that the vulnerability being reported in the media concerns a component supplied by a third party and outside its direct control. Only a limited number of its units were affected and it had taken appropriate measures, the company said. Its statement doesn’t mention EFS. It hasn’t named the component or its maker. It also hasn’t said how the attackers got in, whether other customers were hit or whether its units use any of the controllers French authorities had already flagged.
EFS Was Hit 21 Days After a CERT-FR Refrigeration Alert
CERT-FR, the French government’s incident response team, published alert CERTFR-2026-ALE-012 on 12 October after attacks on supermarket refrigeration in France. It lists numerous compromises of Danfoss AK-SM and AK-SC series controllers. Copeland xweb and Dixell xweb supervisors were added the next day. The alert, last updated on 16 October, tells owners to remove internet exposure from these units, check every setting including defrost schedules and restore remote access only through a secure VPN or protected network. It also warns that attack campaigns against the devices are probably still running and that a factory reset alone leaves an end-of-life unit vulnerable to being compromised again.
On 21 October ANSSI director general Vincent Strubel told a French Senate committee that the supermarket attacks came down to basic security failings and weak passwords, according to a published report. He added that the health sector uses the same kind of refrigeration from research laboratories to pharmacies storing vaccines.
Swedish Stores Lost Stock the Same Night
Overnight into the same Monday, refrigeration failed at a small number of ICA stores and at seven of Coop’s more than 800 stores in Sweden. ICA said the affected stores operate outside its central network. CERT-SE, the incident response function of Sweden’s National Cyber Security Centre (NCSC), said in a short notice on 2 November that it is in continuous contact with affected parties in the grocery sector. The ICA and Coop freezer attack is covered in an earlier report.
Two pro-Russian groups have claimed several of the store attacks in a joint video, according to a published report. That claim hasn’t been verified. EFS has named no attacker.
The Exposure Sat in the Supplier’s System
EFS says its own systems were not the target, its contractor’s supervision platform was. That is the scenario CERT-FR’s alert addresses. It tells owners to move contractor access behind a VPN and to check their insurance terms before cutting the data feed to their refrigeration contractor. The EFS cyberattack came 21 days after the first version of that alert and 12 days after the Senate hearing. Any organisation whose cold rooms are serviced remotely by a contractor already has a published, device-specific checklist to hold that contractor to.
References
- L’EFS confirme l’incident de cybersécurité impactant un de ces prestataires d’équipement frigorifique
- CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
- Cyberangrepp mot uppkopplade frys- och kylsystem
- Published report
- Published report
- Published report
This post is also available in:
Svenska
