Coolworld cold-room systems (EFS blood-service contractor): setpoints raised to 110°C
Severity: medium · Patch status: unknown · Since 2026-11-03
Coolworld, a refrigeration maintenance contractor for France's Établissement français du sang (EFS), was hit by an attack overnight on 1–2 November 2026, according to Le Canard enchaîné (published 3 November 2026) as relayed by Anadolu and cyberattaque.org. Cold rooms normally held at about -30 °C were reportedly reprogrammed to a 110 °C setpoint. The reports do not say the products reached that temperature, and no measured value has been published. An on-duty technician noticed the rise overnight. Le Canard relays that frozen transfusion plasma was among the affected products; the Health Ministry, as paraphrased by Anadolu, reports no operational consequences, and the extent of any product loss is unconfirmed. No attacker, technique, CVE or ransomware claim is published, and no public source ties Coolworld's equipment to the Danfoss/Copeland controller families in CERT-FR alert CERTFR-2026-ALE-012. Recommended actions are OT segmentation, out-of-band temperature alarms, integrity checks on stored products, and reporting to ANSSI.
What to do
- Audit and isolate OT/building-management and refrigeration-control networks from IT systems; enforce segmentation and allowlisting
- Review access controls and credentials for cold-chain monitoring and control systems; rotate exposed credentials
- Verify integrity and safety of stored blood products; check temperature logs for tampering
- Add out-of-band temperature alarms independent of networked controllers
- Report the incident to ANSSI and law enforcement; monitor for follow-on intrusion activity
- Check whether cold-room controllers are Danfoss AK-SM/AK-SC, Copeland xweb or Dixell xweb (CERT-FR alert CERTFR-2026-ALE-012) and apply its guidance; a link to this incident is unconfirmed
Sources
All live incidents on Threat Watch
