Supply‑Chain Attack Manipulates Blood‑Bank Refrigeration Systems in France
What Happened — On 2 November 2026, France’s national blood service (EFS) experienced abnormal temperature and defrost settings in three of its cold‑storage facilities. The disruption originated from a cyberattack against Coolworld Rentals, the provider of the refrigeration units and their remote‑monitoring software. Attackers exploited a vulnerability in a third‑party component used by Coolworld, causing the remote system to raise temperature thresholds. EFS’s own monitoring alarms detected the change, allowing staff to intervene, transfer blood products, and avoid any loss of plasma or other supplies. The incident was reported on 3 November, and EFS is working with France’s national cybersecurity agency (ANSSI) and the Ministry of Health to harden monitoring.
Why It Matters for Trust & Control Assurance — The event underscores the need for robust third‑party risk oversight and continuous assurance that supplier‑managed OT controls remain within your control‑assurance perimeter.
Who Is Affected — National health‑care organizations that rely on external refrigeration equipment; refrigeration‑equipment vendors and their remote‑monitoring service providers.
Recommended Actions –
- Review and augment contracts to require suppliers to provide evidence of vulnerability‑management and secure remote‑access controls.
- Integrate temperature‑sensor logs and supplier‑side incident alerts into your own security monitoring and incident‑response processes.
Technical Notes – Attack vector: exploitation of a vulnerability in a third‑party software component used for remote monitoring of refrigeration units (no CVE disclosed). No data exfiltration reported; impact limited to operational temperature control. Source: https://www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france/