The refrigeration controller attacks that have hit European supermarkets and the UK food supply chain have now reached healthcare. On 3 November, the French Blood Establishment (Établissement français du sang, or EFS), France's national public blood service, said that a refrigeration equipment supplier had suffered a cybersecurity incident on Monday 2 November. Through that supplier's supervision and control system, the temperature and defrost thresholds on cold rooms at three EFS sites in the Bourgogne-Franche-Comté region were raised to extremely high levels. French media report that rooms normally held at minus 30 degrees Celsius were set to 110 degrees Celsius.
The Red Tiger team published the French supermarket wave on 22 October, the wider European wave on 2 November and the UK food supply update on 3 November. We are flagging this update because it is the first confirmed case of the campaign touching medical cold storage, and because the way the attack was caught holds a lesson for every industrial site.
The EFS said its own monitoring and alarm systems spotted the abnormal settings quickly. An on-call technician responded, the affected equipment was brought under control or switched off, and the stored products were moved to other cold rooms as a precaution. Those rooms held donor samples, plasma bags for transfusion and plasma used to manufacture medicines. The EFS reports no health impact and no loss of blood products, and blood collection and distribution continued without interruption.
The supplier, Coolworld, a temperature control rental company operating in France, Germany, Ireland, the Netherlands and the UK, confirmed on 4 November that a cybersecurity incident involved remote monitoring software used in its refrigeration systems. It said only a limited number of its units were affected and that the vulnerability "concerns a component supplied by a third-party provider." The EFS is working with France's national cybersecurity agency (ANSSI) and the Ministry of Health, which says technical investigations continue into how the attack worked and how many units may be affected. Investigators have not named the component, the entry method or the attackers, and it is not yet confirmed whether this incident is linked to the Danfoss and Copeland XWEB controllers named in the earlier CERT-FR alert.
Two lessons stand out. First, the weak point was rented equipment run by a supplier, through the supplier's own remote monitoring service. Chemical plants, pharmaceutical makers, food processors, water labs and port reefer yards all bring in rented chillers, cold rooms, generators and skids that arrive with a vendor's cellular modem or cloud portal already attached. That equipment rarely appears in the operational technology (OT) asset inventory or the remote access policy.
Second, the EFS deputy director told RTL that they caught it fast because they had added their own temperature supervision, separate from the supplier's system. That is defense in depth in practice: an independent sensor and alarm that the attacker could not change at the same time as the setpoint. If the only system watching a process is the same one that controls it, an attacker who takes over the controller can also silence the alarm.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources: BleepingComputer (4 November 2026) ; franceinfo, quoting the EFS statement and the Ministry of Health (4 November 2026) ; RTL interview with the EFS deputy director (4 November 2026) ; Infosecurity Magazine on the Coolworld statement (4 November 2026) ; CERT-FR alert CERTFR-2026-ALE-012
Check out our resources and book a follow-up call with our team.
