SockAnalyst
← All playbooks
HighOT / Healthcare · 2026-11-04

Attackers set French blood bank plasma freezers to 110°C through refrigeration vendor Coolworld

What happened

Overnight Nov 1-2, attackers compromised Coolworld, the refrigeration and maintenance provider for France's national blood service (EFS), and remotely changed temperature and defrost setpoints on plasma cold-storage units from about -30°C to 110°C. EFS confirmed three plasma cold-storage sites in Bourgogne-Franche-Comté were affected. 110°C was the commanded target, not a temperature actually reached. Monitoring alarms and an on-call technician caught the rising temperatures, and the Health Ministry says no blood products, samples or patients were affected. The intrusion method and attackers haven't been disclosed. It follows a wave of attacks on networked supermarket refrigeration controllers in France and other European countries, though investigators haven't formally linked them.

Who's affected

EFS plasma storage (donor samples, therapeutic plasma and plasma for drug manufacturing). More broadly, any hospital, lab, pharmacy or cold-chain operator whose refrigeration or building-management systems are reachable remotely or managed by a vendor.

✅ Fix / patch

  • Inventory every vendor remote-access path into refrigeration, HVAC and building-management systems; remove internet exposure and require MFA plus per-session approval for vendor access.
  • Alert on any setpoint, defrost or alarm-threshold change to cold-storage controllers, especially outside business hours, and keep independent temperature monitoring that the controller can't override.
  • Segment OT and building-management networks from IT and the internet, and patch or replace exposed controllers (ANSSI and Germany's BSI have issued warnings on networked refrigeration controllers).
  • Make sure on-call staff have a tested runbook for cold-chain alarms, including manual override and product transfer.

🔎 Quick hunt check

No public indicators have been released. Review vendor VPN/remote-access logs and controller audit logs for logins and configuration or setpoint changes outside maintenance windows, particularly around Nov 1-2, and look for internet-exposed refrigeration controller web interfaces in your external attack surface.

MITRE ATT&CK: T0822, T0836, T0831, T0883

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=vpn OR index=remote_access (user="*coolworld*" OR vendor_account=true)
| eval hour=strftime(_time,"%H")
| where hour<7 OR hour>19
| stats count min(_time) as first max(_time) as last by user, src_ip, dest
// Off-hours vendor remote access (tag vendor accounts in a watchlist named VendorAccounts)
let vendors = _GetWatchlist('VendorAccounts') | project SearchKey;
SigninLogs
| where UserPrincipalName in (vendors) and ResultType == 0
| extend Hour = datetime_part("hour", TimeGenerated)
| where Hour < 7 or Hour > 19
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location

⏱ CISA deadline

Not in CISA KEV as of Nov 4, 2026.

Sources

Primary source note: EFS statements are quoted by AP and franceinfo, but we could not find a standalone EFS or Coolworld notice.

Related playbooks