Why Hackers Heated France’s Blood Plasma Freezers, And What It Could Cost Next
Hackers who spent October cooking supermarket food across France have moved on to something far more serious: France’s blood plasma freezers.
Overnight from Nov. 1 to Nov. 2, attackers broke into equipment run by Coolworld, a refrigeration firm that services France’s national blood service, the EFS, and set freezers that normally sit at about -30°C to heat to 110°C.
Investigative weekly Le Canard enchaîné revealed the attack on Nov. 3.
Key Takeaways
- Hackers reset blood plasma freezers in eastern France from about -30°C to a target of 110°C. An on-call technician caught it before the plasma thawed.
- It is the third wave in a month, after about 700 French supermarkets on Oct. 11-12 and stores in at least nine European countries on Nov. 2.
- No group has claimed the attacks, asked for money or stolen data, which points away from ordinary cybercrime.
- Supermarket losses already run into millions of euros. A successful hit on blood stocks would cost far more, because France already imports most of the plasma it needs.
What Happened To The Plasma Freezers
An on-call technician noticed temperatures rising during the night of Sunday into Monday. The attackers had changed the setpoint, the temperature the controller tries to reach, from around -30°C to 110°C. The freezers never got close to that, because the change was spotted and reversed in time.
Timing matters here. Fresh frozen plasma has to stay at -25°C or colder, so even a few hours of warming can make a batch unusable for patients.
The EFS first said the affected units held donor samples kept for safety checks. It later told the Canard that frozen plasma meant for transfusions was hit too. The sites named so far are in the Bourgogne-Franche-Comté region. France’s health ministry says the incident had no operational consequences, and no plasma has been reported destroyed.
How many sites were hit, how long the attackers had access and how they got in have not been made public.
A Month-Long Campaign Against Anything Cold
The plasma attack did not come out of nowhere. It is the latest in a run of attacks that all follow the same playbook: get into a refrigeration controller that is reachable from the internet, then flip it from cooling to heating.
| Date | Target | Where | Scale | Damage |
|---|---|---|---|---|
| Oct. 11-12 | Supermarket fridges and freezers | France | About 700 stores | Food spoiled, some fridges caught fire |
| Nov. 1-2 | Blood plasma freezers via Coolworld | France | Not disclosed | Caught in time, no losses reported |
| Nov. 2 | Supermarkets, butchers, one IKEA | Belgium, Netherlands, Sweden, Ireland, Luxembourg, Estonia, Finland, Portugal, Italy | Dozens of stores | Food pulled or thrown away |
In the first wave, France’s finance minister told parliament that about 700 of the country’s 10,000 supermarkets were hit. Stores run by Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc found fridges heated to around 50°C in the morning.
The second wave on Nov. 2 reached chains including Delhaize and Carrefour in Belgium, SuperValu in Ireland, ICA and Coop in Sweden and an IKEA store in Mons. The plasma freezers were hit the same night.
How The Hackers Get In
France’s cyber emergency team issued an alert naming remote controllers made by Danfoss, plus supervision tools sold by Copeland and its Dixell brand. It warned that the campaign was likely still running.
The weak spots are basic. Many controllers sit directly on the internet with a login page anyone can find, and some still use default or weak passwords. Two of the Danfoss models involved stopped getting updates years ago, one in 2016 and one in 2021. Danfoss has said most affected systems were older products that customers had not updated.
Vincent Strubel, head of French cyber agency ANSSI, told a Senate hearing on Oct. 21 that the supermarket attacks exploited basic security failures, equipment exposed online and weak passwords, and that his agency’s advice is not always followed. He also warned that the same kind of equipment is used across healthcare, from research labs to pharmacies that store vaccines. Eleven days later, plasma freezers were hit.
It has not been confirmed that Coolworld’s equipment uses the models named in the alert.
Who Is Behind It And What Do They Want?
Nobody knows for sure. No group has claimed the attacks, and prosecutors in Paris and Brussels have not named suspects. Belgium’s cybersecurity center has said the culprits may never be identified. But the attacks themselves carry clues, and they rule some explanations out.
It Does Not Look Like Ransomware
Ransomware gangs want money. They lock systems or steal data and then send a demand. Here there has been no ransom note, no leak-site post and no reported data theft in any of the three waves. The attacks destroy goods and then stop, which leaves no obvious way to profit.
Theory 1: Low-Skill Hackers Chasing Attention
The method needs little skill. The devices can be found with public internet scanners, and the flaws in the older Danfoss controllers were published in 2025. Ken Munro of security firm Pen Test Partners has said the culprits could simply be kids messing around. Strubel told senators that his agency is seeing more young French attackers driven by reputation rather than money, although he did not tie that trend to these attacks.
Also Read: Fujitsu Unit 1Finity Says Phone Towers Can Run AI TooTheory 2: Deliberate Sabotage Of Supplies
The pattern is harder to square with pranks. All three waves struck overnight from a Sunday into a Monday, when stores and labs are empty and nobody is watching the temperature. Each wave hit many sites in one night, and the second spread across at least nine countries. The targets moved from food to the medical supply chain.
That is consistent with someone who wants to cause as much damage as possible and show they can reach supplies people depend on. EU agriculture commissioner Christophe Hansen has called the attacks a deliberate attempt to disrupt Europe’s food supply and shake consumer confidence. France has been on alert for Russian “hybrid” attacks on critical infrastructure, but no government has blamed Russia, Iran or anyone else for these incidents.
Theory 3: A Test Run
A third reading is that this is a probe. Hitting thousands of controllers, watching how fast companies respond and then moving to more sensitive targets is how an attacker would map weak points before a bigger operation. This is Fathom’s inference, not a finding, and nothing public proves it, but the jump from supermarkets to blood plasma within three weeks is exactly the kind of escalation that worries security officials.
Fathom’s read: whoever is behind it, the attacks are aimed at disruption rather than profit. And the target list keeps getting more dangerous.
What Losses Are Expected If This Continues?
Supermarkets: Millions Of Euros Already
No official national total exists yet, but the store-level numbers add up fast. One Intermarché in Haguenau reported about €50,000 in losses and a Super U in Wasselonne about €220,000. Intermarché’s parent group, Les Mousquetaires, expects losses of several million euros across its roughly 300 affected stores. In Belgium, a single butcher estimated €15,000 of ruined meat after the November wave.
On top of the spoiled stock come cleaning, restocking, fire and sprinkler damage, and the cost of replacing controllers that can no longer be patched.
Blood Supplies: Much Harder To Replace
Plasma is a different kind of loss. It comes from volunteers, so it cannot be bought back off a shelf. France collected only about 35% of the plasma it needed for plasma-derived medicines in 2024 and imports the rest, mainly from the United States, according to a question filed in parliament. Demand for those medicines is growing by about 8% a year.
Even on paper the numbers are large. The EFS sells plasma for medicine-making at a regulated price of €140 per liter, and the government wants to collect 1.4 million liters a year by 2028. A successful attack on a regional stock would wipe out weeks of donations and force more imports at a time when France is trying to cut them.
Transfusion plasma is used to treat bleeding in surgery, trauma and childbirth. If stocks run short, the cost is measured in delayed operations and patient risk, not just euros.
Vaccines And Labs Could Be Next
Strubel’s warning covered research labs and pharmacies that store vaccines. Many of them use the same kind of connected cooling as supermarkets. Each wave so far has been caught or contained within hours, but only because staff noticed in time. The attackers are clearly choosing nights when nobody is watching.
What Happens Next
Investigations are open in Paris and Brussels. CERT-FR has told operators to take controllers off the open internet, change default passwords, use secure remote access and check defrost schedules. It also warned that a factory reset alone does not fix end-of-life devices.
For hospitals and blood banks, the lesson from the Coolworld case is simple. Freezers are now part of the attack surface, and a technician watching the numbers at 3 a.m. may be the last line of defense.
FAQ
What happened to France’s blood plasma freezers?
Hackers changed the settings on freezers used by the EFS through its refrigeration provider Coolworld, from about -30°C to 110°C, on the night of Nov. 1-2. A technician spotted the rising temperatures and no losses have been reported.
Who is behind the fridge cyberattacks?
No one has claimed them and no suspects have been named. Experts are split between low-skill hackers seeking attention and deliberate sabotage of supplies.
Are the supermarket and plasma attacks linked?
They use the same method and came in the same wave of attacks, but investigators have not confirmed that the same people are behind both.
Read Next: A Fake Job Interview Let Hackers Into Binance For Its $6.34B Hack
