Hackers target French blood banks in escalating wave of European industrial refrigeration cyberattacks
A spree of physical-disruption cyberattacks sweeping Western Europe escalated into critical healthcare infrastructure after hackers breached industrial cooling control systems operating across three regional facilities managed by France's national blood agency, the Établissement Français du Sang (EFS). The intruders remotely issued commands to override safety parameters and heat the cold-storage units up to 50°C (122°F), a temperature that would permanently spoil vital blood plasma and donor products.
While secondary analog temperature alarms triggered in time for staff to intervene and prevent inventory loss, the incident signals a dangerous shift from commercial financial extortion toward direct Operational Technology (OT) physical sabotage targeting life-critical healthcare systems.
Low-Tech Exploitation of Internet-Exposed Controllers
Cybersecurity investigators from the French cybersecurity agency (CERT-FR) and independent threat intelligence firms report that the attacks did not rely on custom zero-day exploits or sophisticated malware strains. Instead, attackers systematically scanned public IP ranges to locate connected industrial thermostats and digital refrigeration controllers deployed across the facilities.
The compromised attack chain leveraged simple, systemic OT security oversights. The breached hardware, primarily third-party Danfoss digital controllers provided by refrigeration contractor Coolworld, ran outdated web server firmware containing well-documented vulnerabilities that allowed remote parameter modification.
In multiple instances, remote access points retained factory default admin passwords printed in publicly downloadable user manuals. Once authenticated, attackers simply executed forced-defrost cycles and inverted the control logic, turning cooling compressors into active heating elements.
A Sprawling Campaign Across European Cold Chains
The breach of the French blood banks follows weeks of expanding infrastructure disruptions across Europe. The wave began in mid-October with targeted thermostat overrides hitting roughly 700 French supermarkets, causing over €10 million in physical property damage and massive food spoilage. By early November, the campaign expanded to hit over 40 retail chains across Belgium, Luxembourg, Sweden, the Netherlands, Estonia, Finland, and Ireland.
The tactic also mirrors suspected cyber-sabotage incidents investigated by the U.S. Department of Defense involving mysterious military base commissary freezer failures.
Regulatory Fallout and OT Security Debt
Cybersecurity experts from the UK's National Cyber Security Centre (NCSC) warned that the fridge campaign highlights severe "OT security debt", where physical equipment connected to the internet lacks basic software patching discipline.
Security analysts note that automated scanning scripts and AI-assisted reconnaissance are making it effortless for threat actors, ranging from pro-Russian hacktivists to script kiddies, to discover and abuse forgotten industrial controllers.
European regulators are responding by enforcing strict compliance checks under the EU's NIS2 Directive and DORA framework, mandating that hospitals, logistics networks, and critical utilities immediately pull industrial controllers off the public web and isolate them behind encrypted Virtual Private Networks (VPNs).
