SockAnalystAttackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld
SockAnalyst · Security+ certified analyst.
What happened
Overnight Nov 1-2, attackers compromised Coolworld, the refrigeration and maintenance provider for France's national blood service (EFS), and remotely changed temperature and defrost setpoints on plasma cold-storage units from about -30°C to 110°C. EFS confirmed three plasma cold-storage sites in Bourgogne-Franche-Comté were affected. 110°C was the commanded target, not a temperature actually reached. Monitoring alarms and an on-call technician caught the rising temperatures, and the Health Ministry says no blood products, samples or patients were affected. The intrusion method and attackers haven't been disclosed. It follows a wave of attacks on networked supermarket refrigeration controllers in France and other European countries, though investigators haven't formally linked them.
Update (2026-11-05): FBI, CISA, HHS, USDA and DoT published a joint Cybersecurity Advisory (IC3 CSA, as of Nov 5, 2026) on malicious activity against industrial refrigeration and cold-chain monitoring systems worldwide. Actors are targeting electronic temperature controllers and commercial refrigeration controllers—especially in retail grocery and cold storage—via authentication bypass, arbitrary code injection or weak configurations to remotely alter settings and force continuous heating/defrost cycles; effects include inventory loss, equipment/fire hazard, unsafe stored product, and denial-of-view on current temperatures. No CVEs, vendors or IOCs are named. The FBI Cyber Branch public summary of the same advisory referenced a recent failed attack on refrigeration components at three foreign blood-service facilities where alerts worked, matching this EFS incident.
Who's affected
EFS plasma storage (donor samples, therapeutic plasma and plasma for drug manufacturing). More broadly, any hospital, lab, pharmacy, grocery, cold-storage or refrigerated-transport operator whose refrigeration or building-management systems are reachable remotely or managed by a vendor—Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors called out in the FBI/CISA CSA.
✅ Fix / patch
- Eliminate public internet exposure of refrigeration/temperature controller panels; if remote access is required, put it behind a firewall or updated edge device (FBI/CISA CSA).
- Change default passwords, enforce strong password policy, and use phishing-resistant MFA wherever feasible; inventory every vendor remote-access path and require per-session approval.
- Isolate OT on a dedicated VLAN from business networks; define device/IP allowlists for who can make controller changes; keep firmware patched and retire unsupported EOL devices.
- Define safe setpoint/defrost ranges on downstream devices, alert on any out-of-range or off-hours setpoint/defrost/alarm-threshold change, and keep independent temperature monitoring the controller cannot override.
- Enable and regularly review controller and remote-access logs (or collect OT network traffic when device logs are unavailable); maintain tested offline/offsite backups; make sure on-call staff have a runbook for cold-chain alarms including manual override and product transfer.
🔎 Quick hunt check
No public IOCs, CVEs or vendor names in the FBI/CISA CSA. Review vendor VPN/remote-access logs and controller audit logs for logins and configuration or setpoint/defrost changes outside maintenance windows (especially around Nov 1-2 for this incident), look for internet-exposed refrigeration controller web interfaces in your external attack surface, and alert on temperature readings or setpoints outside the safe ranges you defined. Where OT device logs are weak, collect network traffic between controllers and management hosts.
MITRE ATT&CK: T0822, T0836, T0831, T0883
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=vpn OR index=remote_access (user="*coolworld*" OR vendor_account=true)
| eval hour=strftime(_time,"%H")
| where hour<7 OR hour>19
| stats count min(_time) as first max(_time) as last by user, src_ip, dest// Off-hours vendor remote access (tag vendor accounts in a watchlist named VendorAccounts)
let vendors = _GetWatchlist('VendorAccounts') | project SearchKey;
SigninLogs
| where UserPrincipalName in (vendors) and ResultType == 0
| extend Hour = datetime_part("hour", TimeGenerated)
| where Hour < 7 or Hour > 19
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Supermarket freezers hacked overnight in Belgium and Sweden · Attack · 2026-11-02
- APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV · Exploited vuln · 2026-11-04
- Chainstack breached: customer data and password hashes accessed, node credentials treated as exposed · Breach · 2026-11-04
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free