Overnight, someone remotely changed the cold room settings at France's blood service EFS
On the night of 1 to 2 November, cold room settings at France's blood service EFS were changed remotely through a contractor's monitoring tool. What happened in the next hours, and the bank hit the same week, is in the story.
Overnight from 1 to 2 November, alarms went off in the cold rooms at three sites of France's national blood service, the Établissement français du sang (EFS). Someone had remotely entered the system that monitors and controls the rooms and pushed the temperature and defrost thresholds to very high values. An on-call technician spotted the rise during the night, products were moved to other units, and the equipment was either brought back under control or switched off. According to the statement EFS published on 3 November, no health impact was found and not a single blood product was lost. The French weekly Le Canard reports that rooms normally kept at minus 30°C were set to 110°C. That figure is the target setting sent to the equipment; the temperature actually measured in the rooms has not been disclosed.
What happened that night
According to the EFS statement, the attack did not reach the blood service's own network. It came through the remote monitoring solution of a contractor that maintains the refrigeration equipment, and EFS says it was "not directly targeted". The agency did not name the contractor; French media identify the regional maintenance firm as Coolworld. The affected rooms held health surveillance samples, frozen plasma for transfusion and plasma destined for medicine production.
EFS president Frédéric Pacoud told BFMTV that product safety was not compromised. Pacoud added that had it gone unnoticed, samples and plasma bags meant to treat patients could have been lost. According to Clubic, EFS is now working with France's cyber agency ANSSI and the health ministry. Who carried out the attack and why has not been disclosed.
Why it was caught in time
Blood products survive only within a narrow temperature range, so blood service cold rooms are watched around the clock. The system does two separate jobs: a controller that tells the equipment which temperature to hold, and an alarm that measures the room's real temperature and calls the on-call staff when a limit is crossed. That night the controller side was taken over, while the alarm and the person who answered it did their job. Picture someone secretly turning the thermostat on your fridge at home, and a separate thermometer you put inside it starting to beep. That second layer and the night shift are why nothing was lost.
The link to Europe's refrigeration attacks
The incident follows a series we have been seeing across Europe. On the night of 11 to 12 October, refrigeration units in hundreds of French supermarkets were remotely switched to defrost, and France's cyber response centre CERT-FR issued an alert on 12 October. On 2 November, the same night as the EFS incident, a similar wave hit more than a hundred stores in six countries from Belgium to Estonia. We covered that wave and CERT-FR's step-by-step advice in yesterday's story. No official link between the EFS incident and that series has been announced; the common thread is remote management panels left open to the internet.
The weaknesses of these devices have been known for some time. Security firm Claroty's Team82 published three vulnerabilities in Danfoss AK-SM 800A controllers, which are widely used in supermarkets. The most serious (CVE-2025-41450) allows a login bypass with a hidden "code of the day" derived from the device's date. The manufacturer fixed them in version R4.3.1; Claroty counted 2,765 internet-exposed devices in its scan. Danfoss says most of the units hit in France were older models that no longer receive updates.
A bank in the same week
The second incident making headlines in France this week involves a bank. On 4 November, Crédit Mutuel Arkéa confirmed to AFP that a cyberattack had led to fraudulent transactions. The bank says the incident is under control, some operations were paused as a precaution and there will be no financial consequences for customers. Regional paper Le Télégramme puts the loss at around 118 million euros; the bank has not disclosed the amount or how the attack was carried out. There is no information linking it to the refrigeration attacks.
Where AI fits in
Security experts speaking to AP say there is no sign that AI was used in the refrigeration attacks; known flaws and default passwords were enough. Richard Horne, head of the UK's National Cyber Security Centre (NCSC), said the French fridges were connected directly to the internet with factory passwords. The NCSC's 3 November report considers it highly likely that AI-enabled malware will be used against critical infrastructure by 2028.
The same report puts the spotlight on defence too. The UK is putting 60 million pounds into a National Cyber Shield that will use agent-based AI and 70 million pounds into a NERV centre that will use AI to find weaknesses in infrastructure, and an AI cyber security centre is being set up in Manchester. In December 2025 the US agency CISA and Australia's cyber agency also published a joint guide on safely using AI in industrial systems to catch abnormal behaviour early. On the EFS night, an alarm and a technician did the job; the aim of these tools is to bring the same watchfulness to thousands of devices at once.
If your device is open to the internet
CERT-FR's advice is short: take remotely managed refrigeration and building equipment off the open internet, allow remote access only through a secure VPN, change default passwords, update the software and review defrost schedules. Resetting a compromised device to factory settings wipes what the attacker left behind, but if it is not patched the hole stays open. The same principle applies to smart devices at home: change the factory password and keep automatic updates on.
The EFS night goes on record as one where the attack missed its goal. The controller was taken over, the measuring and on-call system worked, and not a single bag meant for patients was lost. The investigation continues; who was behind it and whether the EFS incident came from the same hands as the supermarket wave is not yet known.
Sources: EFS statement, CERT-FR alert, NCSC, AFP, Crédit Mutuel Arkéa, Claroty Team82, Clubic, Le Canard, weekly newspaper
