A cyberattack targeting refrigeration service provider Coolworld resulted in temperature settings being changed on equipment used by the French Blood Establishment (EFS), raising concerns about the safety of frozen plasma stored for patient transfusions. The incident occurred overnight between November 1 and 2, 2026, with facilities in the Bourgogne-Franche-Comté region among those affected. Hackers reportedly altered refrigeration settings from approximately minus 30 degrees Celsius to 110 degrees Celsius. France’s Health Ministry said staff identified the abnormal readings in time and that the incident did not cause operational consequences. Coolworld provides temperature-controlled equipment and maintenance services, including refrigerated containers used in medical environments. An on-call technician reportedly noticed temperatures rising during the night, allowing the relevant teams to respond before the disruption affected operations. Initial information about the incident concerned donor samples retained for blood safety monitoring. EFS later confirmed that frozen plasma intended for transfusions was also involved. However, there is no confirmation that any plasma was destroyed, transfusions were disrupted or patients suffered harm. The incident highlights the importance of protecting systems responsible for maintaining the temperature conditions required to preserve medical products.
The full extent of the disruption remains unclear, as the number of affected refrigeration units, the duration of the incident and the actual temperatures reached inside stored products have not been publicly disclosed. The reported 110-degree Celsius figure refers to a temperature setpoint, which represents the value requested through a control system. It does not establish that the interiors of freezers, donor samples or plasma bags reached that temperature. Controller settings, measured air temperatures and the temperatures inside stored products are separate measurements, and the distinction is important when assessing potential damage. The actual risk depends on the storage conditions experienced by the products and how long they remained outside approved temperature limits. Fresh frozen plasma requires storage at minus 25 degrees Celsius or below. A prolonged rise beyond permitted limits could make affected supplies unsuitable for transfusion, depending on the temperatures reached and the length of exposure. No public technical findings have identified the hackers, explained how they gained access to Coolworld’s systems or established which equipment was affected. Investigators have also not publicly identified a specific controller model, exploited vulnerability or compromised maintenance account. Claims linking the incident to a particular Danfoss vulnerability would therefore go beyond the available evidence. There is also no confirmed indication that donor information was stolen during the incident.
The Coolworld incident comes amid wider concerns about cyberattacks targeting refrigeration and temperature-control systems. Earlier attacks against supermarket refrigeration infrastructure involved changes to equipment settings that forced systems into continuous defrosting. While these cases demonstrate how digital access to temperature-control equipment can create physical and operational consequences, similar activity does not establish that the same hackers, equipment or access methods were involved in the EFS incident. Separately, an October 12 security alert from CERT-FR confirmed numerous compromises involving Danfoss AK-SM and AK-SC controllers, as well as Copeland and Dixell XWEB systems. The agency warned operators against exposing equipment management interfaces directly to the public internet. Cybersecurity News has also documented internet-facing Danfoss systems, while noting that the appearance of a device in internet search results does not by itself establish that it is vulnerable or compromised. No public evidence has connected those exposed systems to the incident involving Coolworld and EFS. These developments point to broader security concerns affecting connected refrigeration equipment rather than confirming a specific technical link between the separate cases. Industrial and building management systems can become attractive targets because changes to their configurations may affect physical processes, even when an attack does not involve the theft or publication of information.
CERT-FR has recommended several measures to reduce the risk of compromise involving refrigeration and industrial control equipment. These include removing direct public internet access to management interfaces, reviewing complete device configurations, checking defrost schedules and restoring remote access only through secure VPN connections or other protected networks. Operators are also advised to install available firmware updates on supported equipment, replace default passwords and enable applicable security settings. Such measures can help limit unauthorized access and make it more difficult for hackers to manipulate critical equipment remotely. The EFS incident also underlines the importance of safeguards that operate independently of the systems being monitored. In this case, independent temperature monitoring and the response of on-call staff were important factors in identifying the abnormal conditions and allowing teams to intervene. Although the full technical cause of the incident remains unknown, the disruption demonstrates how a compromise involving an external service provider can potentially affect equipment used to preserve essential medical products. Healthcare organizations and their suppliers need to consider the cybersecurity of connected refrigeration systems as part of their wider operational risk management. This includes reviewing supplier access, securing remote maintenance arrangements, monitoring equipment configurations and ensuring that staff can identify and respond to abnormal temperature conditions. While the incident caused no reported operational consequences, the involvement of frozen plasma intended for transfusions illustrates why protecting temperature-controlled medical infrastructure requires both cybersecurity measures and reliable physical monitoring.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
