Field Notes / Breach
Someone set France’s blood-bank cold rooms to 110°C. A second alarm, not the supplier’s, saved the plasma.
Overnight on 1 to 2 November 2026, attackers reached the remote-monitoring software of Coolworld, the company that runs cold rooms for France’s national blood service, and changed the settings at three sites. Rooms that hold donor samples and plasma at -30°C were reportedly told to go to 110°C. No blood was lost, because the blood service watched its rooms with a system the supplier did not control. Here is what is confirmed, and the two questions to ask every supplier with remote access to your equipment.
01 What happened
n the night of Sunday 1 November, the systems that supervise and control cold rooms at three regional sites of the Établissement français du sang (EFS) started reporting “anomalies”. The settings had been changed AFP .
The rooms hold blood samples and bags of plasma for transfusions and for making medicines. They run at -30°C. Le Canard enchaîné, which broke the story on 3 November, reported that some were programmed to reach 110°C and named sites in Bourgogne-Franche-Comté Anadolu . That is a setting the attackers wrote. The samples never got near it.
The rooms are maintained by Coolworld, a Dutch company that rents and manages temperature-controlled storage in France, Germany, Ireland, the Netherlands and the UK. Coolworld confirmed an incident involving “remote monitoring software used in refrigeration systems”. It said a limited number of its units were affected and that the weakness sat in a component from a third-party provider it does not control Infosecurity . It has not named the component.
EFS cut the remote access, stepped up monitoring and moved the stored products to other sites. It reported no health impact and no lost blood products. Collection and hospital deliveries carried on. EFS told France’s cybersecurity agency, ANSSI, and found nothing to suggest its own IT systems were touched. The health ministry says it is still working out how the attackers got in, how many units were affected and when the rooms go back into service AFP .
Nobody has attributed this attack. On 9 November France named Iran’s Revolutionary Guards as the force behind the October attack on about 700 French supermarkets The Record, 9 Nov . Its report does not cover the November wave, and no official source has linked the blood-service sites to it.
02 The alarm the supplier did not own
EFS, via AFP and Infosecurity Magazine, 4 Nov 2026
EFS put it plainly. Its supervision systems were independent of the supplier, and that let it react quickly AFP . Sophie Le Cam, the deputy director general, told RTL the service had added those systems to the installations itself.
Think about the setup most organisations run instead. The supplier installs the equipment and the controller. The supplier’s software sends the alerts. The supplier holds the remote login. An attacker who gets into that software can change the setpoint and also decide what the dashboard shows. The fridge warms up and the screen stays green.
At EFS the attacker changed the supplier’s system and the blood service’s own sensors still told the truth. A person on call read them at night and acted. Nothing about that is advanced technology. It is one probe, one alert route and one phone that the supplier cannot touch.
03 Your suppliers’ remote access
You may not store plasma. You probably have something a supplier looks after remotely: lab freezers, pharmacy fridges, server-room cooling, heating, access control, a production line. Ask every one of those suppliers two questions. How do you connect to our equipment, and from where? If your system were taken over tonight, how would we know?
- List every supplier that can reach your equipment remotely, and the software or portal they use to do it
- Ask each one which third-party components sit in that remote path, and when they were last patched
- Make sure you can cut a supplier’s remote access yourself, at night, without calling them
- Put your own sensor and alert on anything that matters, reporting to people you employ, separate from the supplier’s dashboard
- Alert on any setpoint, schedule or defrost change made outside working hours
- Run the night-time drill once: who gets the alert, who can move the stock, where it goes
EFS learned at night that its second alarm worked. You can find out this week whether you have one. Our third-party access penetration testing covers the remote paths your suppliers hold, shows you what an attacker could change through them, and hands you the fix list. Your red team. Within reach. If you are the supplier in a chain like this one, our partner programme for IT and service providers lets you offer the same testing to your own clients.
Questions readers ask
What happened in the cyberattack on the French blood service cold rooms?
Overnight on 1 to 2 November 2026, attackers altered the settings of cold rooms at three sites of the Établissement français du sang (EFS), France’s national blood service. They got in through remote-monitoring software used by Coolworld, the refrigeration supplier that maintains the rooms. The rooms normally hold donor samples and plasma at -30°C. Le Canard enchaîné reported that some were programmed to reach 110°C. An on-call technician spotted the rise, remote access was cut and the products were moved to other sites.
Were any blood products lost in the EFS attack?
No. EFS said no health impact was identified and no blood products were lost. Blood collection and deliveries to hospitals continued. The 110°C figure was a programmed setting reported by the press, not a temperature the samples reached.
Who attacked the EFS cold rooms, and is it linked to the supermarket freezer attacks?
Nobody has attributed it as of 11 November 2026. On 9 November France attributed the October supermarket attack to Iran’s Revolutionary Guards and the IRGC unit Shahid Kaveh, but its report does not cover the November wave, which included the three blood-service sites. No official source has linked the EFS incident to Iran or to the supermarket attack.
Why did EFS catch the attack in time?
EFS monitored its cold rooms with supervision systems independent of the supplier. When the supplier’s system was altered, the separate system still reported the real temperature, and an on-call technician acted overnight. EFS’s deputy director general said this let the service react extremely quickly.
References
Sources
- Infosecurity Magazine. “France Blood Service Hack Sends Blood Storage Temperatures to 110°C.” 4 November 2026. infosecurity-magazine.com
- AFP via France 24. “Des chambres froides de l’Établissement français du sang victimes d’une cyberattaque d’un prestataire.” 4 November 2026. france24.com
- Anadolu Agency. “French blood storage facilities targeted in cyberattack: Report.” 4 November 2026. aa.com.tr
- CISA, FBI, HHS, USDA and DoT. “US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems.” Joint fact sheet, TLP:CLEAR, 5 November 2026. ic3.gov
- The Record. “France blames Iran for fridge cyberattacks.” 9 November 2026. therecord.media
- Euronews. “France says Iran behind cyberattacks on supermarket fridges.” 9 November 2026. euronews.com
Close the gap this note describes
- Partner programme For MSPs and resellers: offer tested security to your clients without building a team.
- Dark web check for partners For IT providers: name one client and we sweep breach dumps and forums for their leaked credentials.
- Penetration testing You see the way in an attacker would use today, how far it reaches and what to close first.
