Cyberattack Hits French Blood Bank Freezers at Three EFS Sites as Fridge Hacks Spread Across Europe

A cyberattack on a refrigeration contractor reached the cold rooms of France's national blood service, the Établissement français du sang (EFS), on Monday 2 November. At three EFS sites, franceinfo reports, temperature and defrost thresholds in rooms holding plasma for transfusion and for making medicines were pushed to very high values. The EFS says its monitoring and alarm systems spotted the changes quickly, adding: "Aucun impact sanitaire n'a été identifié et aucune perte de produits sanguins n'est à déclarer" (no health impact identified, no blood products lost), and stock was moved to other sites as a precaution.

Besançon and the ministry's response

AFP places one of the three sites in Besançon, where freezers keep samples and blood products at -25°C. EFS director Christophe Barisien told the agency the samples weren't altered.

The health ministry says remote access to the affected units has been cut and that technical investigations are continuing. It hasn't named a suspect.

The contractor and the supermarket wave

Le Canard enchaîné named the contractor as Coolworld, franceinfo says. Coolworld's statement doesn't mention the EFS, but blames a component supplied by a third party that Coolworld doesn't control, and says only a limited number of units were hit.

Supermarket chains were hit again overnight into Monday, 2 November. SecurityWeek counts more than 100 stores in several European countries whose fridges and freezers heated up, some set as high as 50°C. Carrefour counted 15 affected locations out of more than 700, and SuperValu pulled chilled and frozen food from 13 stores. Danfoss, whose store controllers were hit in a French wave in October, said most of the hacked units were legacy products it no longer updated. Whether the EFS equipment was Danfoss hasn't been reported.

The pro-Russian groups Noname057(16) and Z-Pentest Alliance posted online that they had hacked Danfoss, the BBC reports. Threat-intelligence firm Sekoia told the BBC it was "sceptical of their alleged claim of responsibility". How the attackers got in hasn't been publicly explained.

What CERT-FR tells operators

France's CERT-FR alert on the October wave covers Danfoss AK-SM and AK-SC controllers, Copeland xweb and Dixell xweb. It tells operators to take management interfaces off the internet, reconnect them only through a secure VPN or protected network, apply firmware updates, change default passwords and review defrost schedules. For a unit already compromised, it warns that a factory reset alone is not enough: the device has to be reconfigured before it goes back into service.