Health ISAC warns healthcare members after cold-storage cyber attacks

Health ISAC sent a security bulletin to healthcare members on Nov. 6, 2026, warning that cyber attacks on refrigeration controllers threaten the health sector and citing an attack on the French Blood Establishment. The French Blood Establishment, France’s sole civilian organization for blood collection and transfusion, said malicious cyber activity against one of its cold-storage vendors raised defrost and temperature thresholds to dangerous levels. EFS detected the activity in time to rescue blood samples, with no health consequences identified and no blood products lost, and blood collection and distribution were not interrupted.

The intrusion drove temperature and defrosting thresholds to high levels, triggered alarms, and led staff to secure or move plasma as collection and distribution continued. The three affected cold-storage sites, hit overnight between Nov. 1 and 2, 2026, held plasma for transfusions, plasma used to manufacture medicines, and samples for transfusion monitoring. The refrigeration equipment belonged to Coolworld, a supplier and service provider, and the intrusion was in third-party maintenance systems controlling freezer temperatures rather than a direct break-in at EFS. No available report has confirmed that EFS information systems or donor medical information was stolen; the attack changed equipment settings.

Some reporting described a swing from roughly minus 30 degrees Celsius to 110 degrees Celsius, but that figure is unconfirmed and absent from the EFS statement, and unknown whether the freezers actually reached the programmed 110-degree target. The French Health Ministry said the incident produced no serious operational effects because officials saw the temperature spikes quickly and corrected them. EFS technical teams are working with ANSSI and the Ministry of Health and have stepped up monitoring of all equipment.

ANSSI, France’s cybersecurity agency, and the Health Ministry are investigating the blood establishment incident. The alarms operated separately from the compromised settings, a design choice that prevented a loss. EFS distributes cold-stored blood and plasma to about 1,900 healthcare facilities across France. Long interruptions to blood storage may seriously challenge health care providers, since hospitals need steady supplies of stored blood for emergency surgeries, accident victims, cancer patients and transfusions.

The blood bank warning fits a wider pattern of refrigeration attacks across Europe. Initial supermarket reports identified affected stores in Belgium, Luxembourg, Sweden, Finland, Ireland, Estonia and the Netherlands, with some stores in Portugal and Romania also targeted, and Newsweek counted supermarket incidents in at least six countries: Sweden, Belgium, Luxembourg, Ireland, Italy and Estonia. Earlier, attackers modified cooling settings at hundreds of French grocery stores and independent shops, and the finance minister said the attacks involved about 700 of the nation’s 10,000 supermarkets. Coolworld was victimized on Nov. 2, 2026, as a broad wave of supermarket refrigeration attacks in Europe emerged.

ANSSI has looked into refrigeration incidents since mid-October, and its alert names Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb as compromised controller families in the supermarket attacks. ANSSI director general Vincent Strubel issued a warning in October 2026 that refrigeration sites, including ones holding medical supplies, might face attacks. ANSSI said its alert remains under revision and that it cooperates with European counterparts.

Attacks have struck food processing plants and grocery stores at U.S. military bases and in Europe and Israel, leading to spoiled food, fires and broken machinery. In Estonia, attackers changed a Selver store’s refrigeration setting to plus 50 degrees Celsius on Nov. 2, though the provider moved quickly to limit the damage after warnings put grocery store managers on high alert.

On Thursday, the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Health and Human Services and the U.S. Department of Agriculture released a fact sheet covering threats to monitoring systems and industrial refrigeration in cold chains, describing them as critical to health care, chemical production, food and agriculture, and transportation. Brett Leatherman, the FBI Cyber Branch Operations director, said the bureau is following malicious actors who target these systems worldwide, endangering inventory and equipment.

On November 3, NCSC chief Richard Horne said organisations and supply chains rely on weak technology and weak operational foundations, and he named electricity switching, sluice gates, heating and refrigeration controls, manufacturing lines and dam operations as potential cyber targets. Horne called the UK’s exploitable weaknesses a digital Leaning Tower of Pisa.

No group has claimed responsibility for the French Blood Establishment incident or the November supermarket attacks, and the attackers and their motive remain unestablished. Two pro-Russian hacking groups, NoName057(16) and Z-Pentest Alliance, published videos and Telegram posts claiming credit for attacks across Europe and sharing alleged hacked credentials for Danfoss and Copeland equipment. Whether the recent European refrigerator and freezer attacks required stolen credentials is unclear, leading some experts to doubt the groups’ claims.

Tom Hegel of SentinelOne called Russian-aligned actors a credible hypothesis given precedent, though he said that is context, not an evidentiary link to the European incidents. Hegel said Russian threat actors frequently seek attention and falsely claim responsibility for incidents they did not cause, and clear assessments need evidence including links between maintenance accounts on controllers, configuration changes and access logs. Iran has links to at least one earlier Israeli incident, and officials looking into U.S. military base disruptions are weighing Iran as a possible source.

Security firm Claroty released research on flaws in major refrigeration controllers from Copeland and Danfoss after warning the companies about the issues. Some of those flaws have vendor patches, but patching operational technology is difficult because patching requires shutdowns, which is risky for health care, and some aging models have no update path. Patient safety faces extreme risk in health care when even a few minutes of downtime occur.

Nic Adams, CEO of 0rcus, said vendor contracts often mandate ongoing remote access to chillers, which leaves national food and medical supplies open to credential abuse. Shared maintenance accounts, older firmware and internet-connected remote controllers are targets for attackers, and sometimes executives do not know what machines are on their networks.

Xavier Bellekens, CEO of Lupovis, said his firm observed authentication attempts against Danfoss AK-SM refrigeration controller sensors from October 20 through October 30, originating from ASNs labeled bullet-proof hosting and tied to Russian adversaries, most using publicly documented factory-default credentials. Lupovis said the probing appeared to be an attempt to prepare for a widespread, synchronized attack.

Cyber incident responders told NPR they are seeing a massive spike in attacks at least partly carried out by AI agents in recent weeks. Many of these AI-assisted attacks are not particularly sophisticated, novel or stealthy, according to the responders cited by NPR.

Health ISAC’s bulletin links operational technology attacks on specific refrigeration brands to emerging threats facing the health sector. Operational technology describes machines that manage physical processes in the real world, such as cooling systems and water pumps. Errol Weiss, chief security officer at Health ISAC, said health care cybersecurity centers on patient safety and that attackers who manipulate cold-chain storage put life-sustaining physical resources at risk.

The bulletin urges health care organizations to remove public internet exposure and calls for strict network segmentation to separate refrigeration systems from corporate and guest networks. The alert also urges safeguards software overrides cannot bypass, including independent thermal alarms and hard-wired mechanical cutoffs, and calls for separating refrigeration controllers from hospital IT systems and medical gas monitors.

The recommendations include onsite staff training on physical manual control of machines during emergencies and offline backups of hospital systems. Weiss said rapid intelligence sharing lets hospitals and health facilities globally recognize emerging attack patterns and verify vendor exposure, and that it lets them harden critical infrastructure before threat actors cause physical harm.

Reports of refrigeration and freezer disruptions affected supermarkets in France and other parts of Europe, causing temperature fluctuations, food spoilage and financial damage. A heat event spoiling plasma would surface weeks later as a shortage rather than as a stolen file, and because monitoring worked, the blood service lost nothing while supermarkets faced costly but recoverable food losses.