The EFS incident is a near miss that exposes a design problem more than an attack technique. Nobody breached EFS. Someone reached the remote monitoring and control layer of a supplier’s refrigeration equipment and changed the numbers that tell freezers what to do. What protected the plasma was an alarm path that worked and a person who answered it. 

• Confirmed: thresholds for temperature and defrost were raised to very high values at three EFS sites; EFS says no blood product was lost. 

• Not confirmed: how the attackers got in, who they are, whether Coolworld’s own systems were breached, and whether this is linked to the October and 2 November supermarket attacks. 

• The 110 °C figure reported by Le Canard enchaîné is the value requested of the machines, not a temperature any plasma bag reached. 

• Why it matters beyond France: the same class of internet-reachable refrigeration controllers and vendor monitoring platforms sits in hospitals, pharma storage, vaccine cold chains and food distribution. 

What happened in the EFS cyberattack? 

Overnight between Sunday 1 and Monday 2 November 2026, the supervision and control systems of cold rooms at three regional EFS sites were manipulated remotely. EFS described the effect in plain terms: temperature and defrost thresholds were pushed to very high values. Le Canard enchaîné, which broke the story on 3 November, reported that rooms normally held at −30 °C had been programmed to reach 110 °C. 

EFS’s monitoring and alarms flagged the change. An on-call technician saw temperatures climbing during the night, according to EFS accounts relayed by Infosecurity Magazine and Clubic. Depending on the unit, equipment was taken back under control or switched off, and contents were moved to other facilities as a precaution. EFS told Infosecurity Magazine that no blood products were lost and that everything in the affected rooms was moved to safety. 

The Health Minister’s office called the situation under control and under reinforced surveillance. It also said technical investigations continue into the modus operandi, the total number of devices involved, and the schedule for returning affected installations to service (ICI). 

Who is EFS, and why does its cold chain matter? 

The Établissement français du sang is France’s public blood service and, per National Assembly documents, its sole civil transfusion operator. It was created in 2000, per an EFS institutional brochure, and runs collection, processing, storage and distribution of blood components. Its inventory includes plasma intended for direct transfusion and plasma intended for fractionation into medicines; both depend on an unbroken frozen state. 

That makes EFS cold rooms a clinical dependency. A hospital never sees the freezer, but it sees the product that comes out of it. 

What role did the refrigeration supplier play? 

EFS did not name its supplier. Le Canard enchaîné named Coolworld, a Dutch temperature-control rental company operating in France, Germany, Ireland, the Netherlands and the UK, according to Infosecurity Magazine. On 4 November Coolworld acknowledged a cybersecurity incident involving remote monitoring software used in its refrigeration systems. It said only a limited number of its units were affected and that the vulnerability being reported relates to “a component from a third-party supplier” outside its direct control (Coolworld statement). 

Two things follow. First, Coolworld’s wording points to a software component inside the remote monitoring chain, not to a break-in at EFS. Second, its statement does not name the component, say how access was gained, or say whether Coolworld’s own corporate or monitoring environment was entered. Describing this as a “supplier breach” overstates what is public. 

What is confirmed, reported and unknown? 

Confirmed by EFS, the Health Ministry or Coolworld 

• Incident in the night of 1–2 November; three EFS sites affected. 

• EFS was not the direct target; a refrigeration supplier’s equipment and monitoring were. 

• Temperature and defrost thresholds were raised to very high values. 

• Alarms and staff detected it; EFS reports no product loss and no apparent impact on its IT systems. 

• ANSSI has been notified and is working with EFS and the Ministry. 

• Coolworld acknowledged an incident in remote monitoring software on 4 November. 

Reported, not independently verified 

• Coolworld as the supplier to EFS (Le Canard enchaîné). 

• 110 °C as the programmed value. 

• Remote access to the affected units was disabled afterwards. 

• Besançon and Bois-Guillaume among the sites; the third is not identified in reporting reviewed. 

Not public 

• Initial access method, vulnerable component, CVE, and attacker identity or motive. 

• Whether any ransom or extortion demand was made. 

• Financial cost. 

• Whether the incident is linked to the supermarket attacks. Newsweek notes the shared focus on refrigeration does not establish a link. 

How did the EFS cyberattack happen? 

The public record does not say. EFS, the Health Ministry and Coolworld have confirmed an outcome (changed thresholds), a layer (remote supervision and monitoring) and an attribution of fault (a third-party component), but not a pathway. The table separates what is documented from what is open. 

What the October supermarket attacks tell us, and what they don’t 

Three weeks earlier, attackers forced refrigeration controllers in hundreds of French supermarkets into defrost. ANSSI said it was aware of compromised remote controllers from Danfoss (AK-SM and AK-SC), Copeland XWEB and Dixell XWEB. Danfoss said most affected units were old models without security updates, or newer ones running outdated firmware. 

Two technical facts from that case matter here. Danfoss patched CVE-2025-41450 (authentication bypass) in 2025, and CVE-2025-41451 (post-authentication command injection) and CVE-2025-41452 later that year. A Claroty researcher has since shown how two of them can be chained to run commands, disable cooling and falsify temperature readings (Infosecurity Magazine). And Censys counted 2,991 internet-exposed Danfoss StoreView panels on 11 October, 61% in France, falling 71% in France to 537 by 14 October. Operators were pulling devices offline rather than patching them. 

This is context, not evidence about EFS. BleepingComputer cites the Danfoss CVEs but says it is unconfirmed whether they were used. Nothing public ties the EFS incident to the same actors, products or CVEs. 

How an attack like this could happen: a technical reconstruction 

Everything in this section is hypothetical. It describes plausible pathways in typical remote-managed refrigeration estates, not what happened at EFS. 

1. Exposed controller or site supervisor. A web-managed controller reachable from the internet, with default, shared or predictable credentials or an unpatched authentication flaw. This is the October supermarket pattern. It requires no supplier compromise at all. 

2. Compromised vendor monitoring platform. A fleet-management or cloud service that holds credentials or tokens for many units. One intrusion lets an attacker write setpoints to every unit the platform manages. Coolworld’s “remote monitoring software” wording fits this layer. 

3. Stolen technician or vendor credentials. Valid accounts on a VPN, remote-support portal or jump host give an attacker the same reach as an engineer, and the same logs. 

4. Vulnerable third-party component. An embedded web server, gateway firmware or library inside the monitoring product. This matches Coolworld’s wording most literally, and it is still a guess. 

What each pathway has in common is write access to parameters, not a need for malware. Changing a threshold is a legitimate function of the system. That is why the attack is quiet to every control except one that watches the physical temperature independently. 

How do industrial refrigeration systems work, and where do they fail? 

The components below are representative of remote-managed cold rooms. They are not a statement about what was installed at the affected EFS sites.

Defrost is the sharp edge. A defrost cycle deliberately heats the evaporator to clear ice. If the termination temperature or interval is raised, the heater keeps running and the room warms. In the supermarket case, reporting from Al Jazeera described temperatures up to 50 °C and fires at several stores. At EFS, the reported 110 °C is a setpoint, and no source says any room reached it. 

IT security prioritizes confidentiality, then integrity and availability. In a cold room the order flips. Availability and the integrity of the process value decide whether product survives, and a data-breach playbook has nothing to say about a freezer drifting from −30 °C. The real risk is a setpoint, an alarm limit and a displayed reading that an attacker can all change from the same login. Clubic relays ESET’s Benoît Grunemwald making the same point: independent temperature supervision matters because a compromised system can both change settings and make everything look fine. 

Why does blood component storage depend on stable temperatures? 

Every blood component has its own storage window, and the windows are not interchangeable. The EFS rooms held frozen plasma, so the relevant figure is the plasma one. 

Red cell and platelet figures are widely used reference values and were not re-verified in this session. Plasma figures follow the UK Red Book plasma specification and the NZBS monograph, which cite the Council of Europe Guide. Check the current ANSM and Council of Europe Guide text before publishing a specification. 

Three different temperatures get conflated in coverage of this incident. The setpoint is what the controller is told to reach. The room temperature is what a probe measures. The core temperature of a bag is what the product actually experienced, and it lags the air because frozen plasma has thermal mass. Cyberattaque.org makes this distinction explicit, and it is why a headline “110 °C” says nothing about product quality. 

Whether a warming event ruins plasma depends on how far and how long. The UK blood services publish a guidance note on deviations from specified frozen-plasma storage temperature built on factor VIII data, notes that it does not apply to plasma for fractionation, and says the decision should rest on local risk assessment. In practice, an excursion triggers a review of temperature records, quarantine of affected stock and a release-or-discard decision under the quality system. That is general practice, not a description of EFS’s procedure. 

This is why early detection mattered. EFS’s president told BFMTV that EFS could have lost samples or bags of plasma, and that the early warning meant product safety was not compromised (Infosecurity Magazine). 

Were patients or hospitals affected? 

No patient harm and no hospital supply disruption has been reported. EFS says no blood product was lost, and Clubic reports that collection and distribution continue normally. The Health Ministry’s line is that there were no operational consequences because the event was detected. That statement is EFS’s and the Ministry’s own account. No independent audit of inventory has been published. 

The potential consequence is clear enough to state without exaggeration. Had alarms failed overnight, a plasma bank could have faced quarantine or discard of transfusion plasma and fractionation plasma, and hospitals would have drawn on remaining stock. 

Who was behind the EFS cyberattack? 

Unknown. No ransomware group, hacktivist collective or state actor has claimed it, no authority has named a suspect, and no ransom demand has been reported. Newsweek notes that public accounts neither identify the attacker nor show the same method as the supermarket intrusions. 

Early attribution is unreliable here for structural reasons. Anyone who can reach an exposed or poorly authenticated controller can change a setpoint, so a low-skill actor and a capable one leave similar traces. Setpoint changes carry no malware signature. And sabotage, extortion and opportunism look the same until someone claims or negotiates. Treat any firm attribution published this week as unverified. 

What was the impact and what did it cost? 

No monetary figure for EFS has been published, and none is asserted here. For scale, the October supermarket attack affected an estimated 700 of France’s 10,000 supermarkets according to the finance minister, per Newsweek. That figure measures a different incident. 

Why is third-party remote access such a risk for OT? 

The operator owns the product and the consequences. The supplier owns the equipment, the monitoring software and the credentials. In a leased or fully managed cold room, nobody in the hospital or blood service can see the controller’s patch level, the firmware of the gateway, or who at the supplier has write access. 

That gap is the story of both the October and November incidents. Public procurement notices show EFS regional entities tendering for rental of modular cold rooms and for cold-room maintenance. The excerpts reviewed do not name Coolworld, so nothing should be inferred about the affected contracts. The structural point stands: outsourced refrigeration moves control of a clinical dependency outside the operator’s security perimeter. 

The risk pattern has measurable support in industry data, with caveats: 

• Claroty Team82, “An Open Door” (2024): 13% of the most mission-critical OT assets studied had insecure internet connections, and 36% of those carried at least one known exploited vulnerability (press summary, Japanese). 

• Dragos annual OT/ICS report covering 2024: 65% of sites Dragos assessed showed insecure remote access conditions such as default credentials and unpatched systems (Industrial Cyber summary). This measures assessed sites, not all industry, and it is a secondary extract. 

• Censys, 11–14 October 2026: 71% fall in French internet-exposed Danfoss StoreView panels in three days, driven by taking devices offline, not patching. 

A practical third-party OT risk assessment framework 

Score each supplier 0 (absent) to 3 (enforced and evidenced). Anything scoring 0 on the first three domains is a finding, whatever the total. 

Which MITRE ATT&CK for ICS techniques apply? 

None is confirmed as an observed adversary behaviour. The table maps the confirmed outcome and the plausible pathways, and labels each. Technique IDs follow MITRE ATT&CK for ICS; the matrix could not be opened in this session, so verify names and IDs against the current release before publishing. 

Which standards and regulations apply? 

Applicability is a legal question, not a guess. Only voluntary frameworks can be recommended without checking classification. 

None of these automatically binds EFS or Coolworld. Which obligations apply depends on entity classification, the final French law and contract terms. Secure remote access, segmentation, supplier requirements and monitoring are expected under each of them regardless. 

How can similar attacks be prevented? 

Six moves do most of the work. They are ordered by how much risk each removes per unit of effort. 

1. Take controllers and supervisors off the public internet. CERT-FR’s guidance after the supermarket attacks was to eliminate direct internet exposure, secure remote connections and update supported equipment (eSecurityPlanet). Censys data shows how fast operators can move once the risk is concrete. 

2. Put every vendor path behind a broker you control. No inbound internet to OT; vendors connect to a gateway, not to devices. 

3. Treat setpoints, defrost parameters and alarm limits as safety parameters. Changes need an approved window, an owner and a record, whoever makes them. 

4. Build an alarm path that does not trust the controller. Independent probes, an independent logger and a separate notification route. If the controller is compromised, this is what still tells the truth. 

5. Find and retire end-of-support equipment. Danfoss’s AK-SC355 reached end of life in 2016 and AK-SM800 in 2021 (Wikipedia summary). Where replacement is slow, isolate. 

6. Write the supplier’s obligations into the contract. Patch timelines, component transparency, incident notification windows, access logging, and the right to audit. 

What does a secure vendor remote access architecture look like? 

The principle is that the vendor never reaches a controller directly. A named vendor engineer authenticates with MFA to an access broker in a DMZ. The broker checks an approved request, opens a time-limited session to a hardened jump host, and records it. An OT firewall allows only the specific protocol from the jump host to the specific controllers in scope. Nothing initiates a connection from the internet into the cold-room network. 

A secure maintenance session, step by step 

1. The supplier raises a work order naming the engineer, the controllers and the planned change. 

2. The site approves it and sets a window. 

3. The engineer logs in to the broker with MFA; the vault injects credentials they never see. 

4. The broker opens a recorded session to the jump host, scoped to the listed controllers. 

5. The firewall permits only the maintenance protocol to those addresses. 

6. The monitoring tool compares each parameter write against the work order. 

7. The session ends at close or expiry; access and credentials are revoked. 

8. The site diffs controller configuration against the approved baseline and files the recording with the work order. 

How can organizations detect an attack like this? 

No incident-specific indicators of compromise have been published, and none are invented here. Detection rests on behaviours that any parameter-manipulation attack on a cold room must produce. 

Signals are weak alone and strong together. Correlate four data planes: network traffic, remote-access sessions, configuration changes and physical measurements. A setpoint write at 02:14 with no approved work order, arriving from the vendor platform, while an independent probe shows a 0.3 °C per minute rise, is a high-confidence alert. A rate-of-change alarm on the independent probe will fire within minutes, long before an absolute threshold does. 

What should operators do now? A remediation roadmap 

The sequence matters. First confirm physical reality, then cut the attacker’s path, then preserve evidence, then rebuild the design. 

First 24 hours 

First 7 days 

First 30 days 

90 days and beyond 

A 25-point OT security checklist for temperature-controlled environments 

Use this for blood banks, hospital pharmacies, vaccine stores, laboratories, pharmaceutical and food cold chains. 

Asset visibility 

• 1. An inventory lists every controller, gateway and supervisor with model, firmware and support status. 

• 2. Every remote path into the site is mapped, including vendor cloud portals and cellular modems. 

Network architecture 

• 3. Cold-room controllers sit in a dedicated zone behind a firewall, not on the corporate LAN. 

• 4. An external scan shows no controller or supervisor reachable from the internet, repeated quarterly. 

Remote access 

• 5. All vendor access goes through a broker or jump host with session recording. 

• 6. No always-on tunnels exist, and every vendor portal has an owner and a review date. 

Authentication 

• 7. No default, shared or date-based credentials exist on any device. 

• 8. MFA protects every remote login and every supervisor login. 

Controller security 

• 9. Firmware is supported and patched; end-of-support units have a replacement date or isolation plan. 

• 10. Unused network services are disabled, and local write protection is enabled where the controller supports it. 

Temperature monitoring 

• 11. Independent probes and a data logger run on a path that does not share the controller’s software. 

• 12. Rate-of-change and high-temperature alarms exist, not only absolute limits. 

• 13. The alarm chain is tested monthly end to end, down to a named on-call person. 

Configuration management 

• 14. Approved setpoints, defrost parameters and alarm limits are stored offline as a baseline. 

• 15. Automated drift detection alerts on any deviation from that baseline. 

Vendor management 

• 16. Contracts require component transparency, patch timelines and incident notification within a fixed window. 

• 17. Vendor access is reviewed quarterly and revoked on contract end. 

Threat detection 

• 18. Passive OT monitoring sees parameter-write commands, not only connections. 

• 19. Parameter changes are matched against approved work orders. 

Incident response 

• 20. A refrigeration-specific playbook covers isolate, verify, move product, preserve evidence, notify. 

• 21. A tabletop exercise including the supplier runs at least twice a year. 

Backup and recovery 

• 22. Known-good configuration backups exist and a restore has been tested. 

• 23. A spare controller or documented reinstall procedure is available on site. 

Operational resilience 

• 24. Alternate storage exists with capacity for the largest room. 

• 25. A manual monitoring routine with a calibrated thermometer is rehearsed for loss of remote visibility. 

Ten lessons for CISOs and OT security leaders 

1. Support equipment becomes critical when it protects a clinical product. A rented cold room is a patient-safety system. 

2. The supplier’s software is your attack surface. If you cannot name the components in a vendor’s monitoring stack, you cannot assess your exposure. 

3. A setpoint is a safety parameter. Treat changes to temperature, defrost and alarm limits with the same change control as a pressure relief setting. 

4. Independent monitoring was the control that worked. Design it so the controller and the alarm cannot be silenced by the same login. 

5. All remote access to OT is privileged access. Any session that can change a process value can affect safety and availability. 

6. Internet exposure can be reversed in days. Censys saw French operators cut exposed panels by 71% in three days. The barrier was urgency, not engineering. 

7. Leased and managed equipment needs security clauses. Patch timelines, component disclosure, notification windows and audit rights belong in the contract. 

8. Keep three temperatures apart in response and communication. Setpoint, room reading and product core temperature answer different questions, and conflating them produces headlines like “110 °C”. 

9. Rehearse the 3 a.m. case. Detection here depended on a person on call. Test who is woken, how, and what they do first. 

10. Agree who tells whom, and how fast. The public record does not show when EFS or Coolworld first learned of the intrusion. A contract should. 

What does the EFS incident mean for critical infrastructure? 

Within three weeks the same class of remotely managed refrigeration equipment was used against supermarkets and then against a blood service. Nobody has shown the two are linked, and that is beside the point: the weakness is shared. Remote-managed refrigeration, humidity and temperature control protect product in many sectors. 

• Hospitals and blood banks: plasma, platelets, reagents, pharmacy stock. 

• Vaccine and biologics storage: 2–8 °C and ultra-low freezers with the same remote monitoring pattern. 

• Pharmaceutical manufacturing and laboratories: stability chambers, sample archives. 

• Food and beverage cold chains and warehouses: the October case. 

• Data centres and utilities: cooling plant managed by the same kind of vendor platforms. 

The rule that follows is simple. Refrigeration, building management and environmental monitoring belong inside the OT security perimeter, with the same asset visibility, access control and monitoring as production systems. 

Conclusion 

The EFS cold rooms did not fail because of a clever attack. As far as the public record shows, they were threatened by a change to numbers that a remote system is allowed to change, and they were saved by an alarm and a technician. The attack method is still undisclosed; the design lesson is not. 

Third-party access should never become an uncontrolled pathway into critical operational infrastructure. Organizations operating healthcare, pharmaceutical, industrial and other temperature-controlled environments need visibility into their OT assets, control over vendor access, continuous monitoring and tested incident response. 

Shieldworkz provides end-to-end industrial OT cybersecurity products, services and solutions, including OT risk assessments, asset discovery, secure remote access design, industrial network monitoring, third-party OT risk assessments and incident response. To discuss your cold-chain or critical-infrastructure environment, visit shieldworkz.com or contact the Shieldworkz OT security team. 

Additional resources     

Comprehensive Guide to Network Detection and Response NDR in 2026 here 
A downloadable report on the Stryker cyber incident here     
Remediation Guides here   
OT Security Best Practices and Risk Assessment Guidance here  
IEC 62443-based OT/ICS risk assessment checklist for the food and beverage manufacturing sector here