Set to 110 °C: The Night Hackers Reached a Blood Bank’s Plasma Freezers — and Why the Alarm Won

By Thorsten Meyer | November 4, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Key takeaways

• What happened: During the night of Sunday 1 to Monday 2 November 2026, someone reached the remote supervision system of a refrigeration contractor and raised the settings of cold rooms at three sites of France’s national blood service, the Établissement français du sang (EFS). The rooms held frozen plasma for transfusions and for making medicines.
• 110 °C was a number typed into a controller, not a temperature anybody measured. According to Le Canard enchaîné, rooms that should run at −30 °C were programmed to +110 °C. The real danger was thawing: frozen plasma has to stay at −25 °C or colder.
• The alarm won. EFS monitoring and alarms, plus an on-call technician, caught the rise in the night. The bags were moved. The EFS reports no health impact and no loss of blood products.
• Same night, many countries: the blood bank case happened during the same night as the second wave of attacks on supermarket refrigeration, which hit at least 11 European countries. No authority has linked the two.
• New since Wednesday morning: two hacktivist groups that describe themselves as pro-Russian claimed the supermarket attacks in a video. The claim is unverified, the posts were deleted again, and no government has attributed the attacks to anyone.
• For businesses: the common thread is remote maintenance access by third parties. Alarms that work independently of the control system, manual checks and a plan for moving stock are what turned this night into a non-event.

Sunday night in eastern France. In a blood service cold room, bags of frozen plasma sit at minus 30 degrees. They are waiting to be transfused into patients, or to be turned into medicines. Somewhere else, someone logs into the system that controls the room and types in a new target: plus 110.

Then an alarm goes off. An on-call technician sees the temperature curve start to climb. By morning, the bags are somewhere else, and nobody has been harmed.

Two days ago we covered the second wave of attacks on Europe’s supermarket refrigeration, the night freezers in a dozen countries turned warm. We now know the same night also reached a blood bank. This is the follow-up: what is confirmed, what is exaggerated online, why the alarm won, and what a coordinated attack on cold chains would mean in a real crisis.

Products Worth Considering

LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor

AmazonView Latest Price

LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor

AmazonView Latest Price

LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What happened at the blood service

The EFS is France’s national blood service. It collects blood donations and supplies hospitals across the country. Its communiqué of 3 November, quoted by franceinfo and Next on 4 November, says the following:

• One of its refrigeration equipment contractors was “the victim of a cybersecurity incident”. The EFS does not name the contractor.
• Affected were “the supervision and control installations of cold rooms deployed at three EFS sites”.
• “Temperature and defrost thresholds” were raised “to very high temperatures”. The communiqué gives no number.
• The rooms held bags of plasma for transfusion, and plasma for fractionation, the process that turns plasma into medicines.
• “The EFS monitoring and alarm systems made it possible to identify these anomalies quickly.” The equipment was brought under control or switched off, and the contents were moved to other installations as a precaution.
• “No health impact has been identified and no loss of blood products is to be reported.” Technical teams are working with the national cybersecurity agency ANSSI and the health ministry, and temperature monitoring across all EFS equipment has been stepped up.

Most of the colour comes from one paywalled source. Le Canard enchaîné broke the story in its issue of 3 November. As reported by the Canard, and quoted by Solutions Numériques and L’Express via Orange:

• The contractor is Coolworld, a company that rents and maintains refrigerated rooms and containers. That name comes from the Canard only. Coolworld has not commented publicly, and the EFS says it was not directly targeted.
• One affected region is Bourgogne-Franche-Comté. The other two sites are not public.
• Rooms meant to run at −30 °C were reprogrammed to 110 °C.
• “An on-call technician noticed during the night from Sunday to Monday a rise in temperature in the cold rooms.”
• The EFS first spoke of samples from a health surveillance scheme, then confirmed that frozen plasma for transfusion was stored there too.
• The health ministry: “There is zero operational consequence, because the situation was spotted.”

EFS president Frédéric Pacoud told BFMTV on 4 November: “We could have lost samples or bags of plasma intended to treat patients.” He added that the safety of the products was not affected.

110 °C: a setting, not a temperature

The number that travelled around social media is 110 °C, often with the words “boiled blood”. That is wrong.

The 110 °C was a setpoint: the target value a controller is told to reach. No source reports a measured temperature anywhere near it. A cold room is not an oven. Its only heat sources are its defrost heaters and the air around it. In the supermarket attacks, which used the same trick of forcing defrost cycles, the highest temperatures reported were about 50 °C. In Reisbach, Bavaria, cooling systems were heated to up to 50 °C; in Lilienthal near Bremen, to 30 °C (ZDFheute). An Estonian store reached 50 °C (Euronews).

The real risk sits at the other end of the scale. European guidance from the EDQM, as summarised by the International Society of Blood Transfusion, says fresh frozen plasma is frozen and stored at −25 °C or colder. A room that drifts well above that line is a problem long before anything gets warm. Plasma that may have thawed can’t simply be refrozen and used. That is why the alarm mattered, and why “only” a few degrees could have meant throwing bags away.

There is a second lesson in the number. A controller that accepts +110 °C as the target for a freezer has no sanity check. Plausibility limits on setpoints are one of the cheapest protections there is.

Why the alarm won

This is the part of the story that rarely makes the headline. The attack worked, technically. The safety net worked better.

Three things came together. First, the EFS had temperature monitoring with alarms, and according to its own communiqué that is what spotted the anomaly. Second, a person was on call at night and acted. Third, there was somewhere else to put the plasma. Detection, a human and a plan B.

Compare that with some of the small supermarkets hit the same night. Many lost their frozen stock. In Lilienthal, Germany, the owner said his store had to throw away goods worth more than €360,000, according to ZDFheute. The difference was not the attacker. It was what the victim had in place.

The same night across Europe

The blood bank case happened during the second wave of supermarket attacks, not after it. That matters, because posts online describe it as the hackers “moving on” to medical targets. Nothing official supports that sequence, and no authority has said the two are connected.

Here is what was reported for that night, with the corrections the viral posts miss. Supermarkets and food shops were hit in Belgium, the Netherlands, Luxembourg, Ireland, Sweden, Estonia, Portugal, Italy, Germany and Romania. Portugal is missing from most viral lists, although seven Intermarché stores were hit via an external service provider. In the United Kingdom the victims were meat suppliers and a wholesaler, not supermarkets. In Finland a cyberattack has been “not ruled out”, but not confirmed. And in France, the same night, three sites of the blood service.

AFP counts “at least 11” countries (Al Jazeera with AFP and Reuters, 4 November; Euronews, 3 November). 50 °C is the maximum, not the norm: many stores reported lower values.

What governments are saying

The official voices are calm, and they don’t agree on everything.

• EU Commission: spokesperson Thomas Regnier said on 3 November: “These are not isolated incidents, and of course, we have to be collectively resilient and prepared for such cyber incidents.” He named no culprit. Agriculture Commissioner Christophe Hansen had called the attacks “a deliberate attempt to disrupt our food supply chain and undermine consumers’ confidence in it” (Infosecurity Magazine, citing Politico). Both statements were about food retail, not the blood service.
• Italy: the government held a security meeting with its intelligence services and called the impact limited. According to the government, only outlets with outdated security were hit.
• Romania: Dan Cimpean, head of the national cyber directorate DNSC: “It seems semi-amateurish. We do not suspect, under any circumstances, that it is a state actor.”
• United Kingdom: Richard Horne, head of the NCSC, said the problem touched “the whole food supply chain”, with national impact minimal (The Record, 3 November).

New: a claim nobody has verified

On Wednesday, 4 November, Italy’s public broadcaster Tg1 reported that two hacktivist groups that describe themselves as pro-Russian, NoName057(16) and Z-Pentest, claimed the supermarket attacks in a video posted on social media (Il Mattino and Open, citing Tg1). The message speaks of a “devastating blow” against Danfoss and Dixell refrigeration equipment. Cybernews reports that the groups’ Telegram posts were deleted again.

Five things to keep in mind:

• Who the groups are. NoName057(16) is known mainly for DDoS attacks, which flood websites with traffic until they go offline. In July 2025, an international operation coordinated by Europol and Eurojust, called Eastwood, disrupted more than one hundred of the network’s computer systems; seven arrest warrants were issued (Europol). Z-Pentest is one of the pro-Russia hacktivist groups named in the joint advisory CISA AA25-343A, which describes attacks on internet-exposed control screens in water, energy, and food and agriculture.
• A claim is not proof. No government or investigator has confirmed it. The same advisory warns that these groups “regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention”. SentinelLABS adds that opportunistic claims can make unrelated activity look like a single campaign.
• Naming the equipment proves nothing. The message names Danfoss and Dixell devices. Both have been on CERT-FR‘s public list of targeted equipment since October, so anyone could have named them.
• The claim, as reported, is about supermarkets. We found no report that it mentions the blood service.
• A hacktivist group is not a government. Even if the claim turns out to be true, who is behind the groups is a separate question. Romania’s cyber chief, for one, sees no state actor in this wave.

Scenario, not an accusation

As of 4 November, no government has attributed these attacks to anyone. Two hacktivist groups have claimed the supermarket attacks; that claim is unverified. What follows is a thought experiment, clearly separated from the facts above.

What “hybrid” means

The EU defines hybrid threats as “the mixture of coercive and subversive activity, conventional and unconventional methods (…), which can be used in a coordinated manner by state or non-state actors to achieve specific objectives while remaining below the threshold of formally declared warfare” (JOIN(2016) 18). The Hybrid CoE in Helsinki adds that such activities “exploit the thresholds of detection and attribution”.

In plain words: deniable, below the level of war, aimed at weak spots and at public trust. That is why “amateurish” does not rule anything out. It does not prove anything either.

Cases that governments did attribute

These are other cases, not these attacks. They show what officially attributed sabotage of everyday infrastructure has looked like:

• Denmark, Køge water utility (December 2024): attackers changed pump pressure and several pipes burst. In December 2025, Denmark’s defence intelligence service said the group Z-Pentest was behind it and “has connections to the Russian state” (SecurityWeek). The US-led advisory, by contrast, describes Z-Pentest as having formed “separate from GRU involvement”. Even governments assess these groups differently.
• Norway, Bremanger dam (April 2025): a valve was opened through a web panel with a weak password. Norway’s security service blamed pro-Russian cyber actors, saying the aim was “to cause fear and chaos among the general population” (CCDCOE cyber law toolkit).
• Poland, Warsaw–Lublin rail line (November 2025): an explosion on a line used for aid to Ukraine. The government said Russian secret services were behind it (CNN).
• Joint advisory AA25-343A (December 2025): pro-Russia hacktivists attack internet-exposed control screens in water, energy and food and agriculture, with “less sophisticated, lower-impact attacks” than state hacking teams.

The assessments today

SentinelLABS, the research arm of a security company, wrote on 3 November: “Russian-aligned groups are credible suspects, but attribution remains open.” It names copycats, financially motivated intruders and other state-linked actors as also fitting the public facts, and warns that “opportunistic claims may make unrelated activity look like a single campaign”. Romania’s cyber chief, as quoted above, sees no state actor at all.

What a coordinated attack on cold chains would mean in a crisis

Supermarkets, blood banks, pharmacies and vaccine stores share the same weak spots: maintenance by contractors over the internet, management screens that can be reached from outside, old controllers, and setpoints without limits. Forescout counted 12,976 internet-exposed refrigeration management services in 99 countries in October and warns that the risk extends to cooling equipment in hospitals.

In a real crisis, three things would make the same trick far worse:

1. Many sites at once. Technicians, inspectors and backup storage would run out before the problems did.
2. A combination with other disruptions. Add a power cut, a telecoms outage or a rumour like “the blood supply is contaminated”, and the damage to trust could be larger than the damage to goods.
3. Some goods can’t be replaced quickly. Food can be reordered. Plasma comes from donors and takes time to collect, and some medicines have long production times.

What limits the damage is just as concrete. Cold chains are decentralised: thousands of devices from different makers, not one switch. Independent alarms and people on call caught the EFS case. Manual temperature checks and logs catch what software misses. Spare storage lets products be moved. European cyber crisis networks and national CERTs are already working across borders.

The realistic conclusion: so far, these attacks have caused spoiled goods and fear, not casualties, because the safety nets held. The risk lies in the combination, and in the long tail of devices nobody maintains.

What this means for businesses

If you run cold storage of any kind, from a butcher’s freezer to a pharmacy fridge or a lab, this night is your checklist.

• Know who can reach your systems remotely. In the EFS case, in Portugal and in at least one German store, the trail leads to a third party’s remote maintenance access. Ask every contractor: who can log in, from where, and change what?
• No management interface on the open internet. Service access only through a VPN or a secured gateway, with multi-factor authentication and named accounts, never shared logins. Read-only by default (CISA AA25-343A; CERT-FR).
• Separate the alarm from the controls. Temperature logging that runs on its own system, with its own alerts by SMS or phone, still works when the controller is compromised. That is what saved the plasma.
• Plausibility limits on setpoints. A freezer should never accept +110 °C.
• Manual checks and a paper fallback. Scheduled temperature checks and logs, and staff who know how to switch to manual operation.
• An emergency plan for stock. Who moves what, to where, at 3 a.m.? Spare capacity or an agreement with a neighbour.
• Segmentation and updates. Keep refrigeration and building systems on their own network segment, apply firmware updates, and plan to replace devices that no longer get them.
• Check your insurance. Find out whether stock lost through a cyber incident on building technology is covered, and talk to your insurer before you change remote access. CERT-FR gives the same advice.
• Regulation. The EU’s NIS2 directive lists health as a sector of high criticality. It covers healthcare providers and pharmaceutical manufacturing, which is where blood services and plasma fractionation sit. How a specific blood service is classified depends on national law; we have not verified the EFS’s status. Food retail, by contrast, is largely outside NIS2, which covers only wholesale and industrial food production. Many affected stores have no reporting duty at all.

This is general information, not legal or professional security advice.

What this means for you

• Blood and medicines are safe for now. The EFS reports no health impact and no lost blood products, and the health ministry says there was no consequence for patients. Nothing in this case is a reason to stop giving blood. Blood services depend on donors, and rumours that the supply is unsafe help no one.
• Food: Belgium’s food safety agency tells stores to check temperatures themselves and remove products if limits were exceeded or there is doubt (see our earlier article). If you bought frozen food this week, look out for signs of thawing such as large ice crystals or clumped contents, and check use-by dates.
• Stay with official sources. Follow your blood service, your national cyber agency and your food authority, not viral posts. The posts about this case got the temperature, the sequence and the country list wrong.

What we don’t know

• How the attackers got in at the contractor: weak passwords, an exposed interface or stolen maintenance access. Nothing has been published.
• Which controller or manufacturer was involved at the EFS. We don’t name one, because no source does.
• Whether only settings were changed, or displayed values too.
• Whether the same people were behind the supermarket wave and the blood service case.
• Whether the claim by NoName057(16) and Z-Pentest is genuine, and whether it covers the EFS at all.
• Whether AI tools played any role. No authority has said so, and we found no evidence.
• Whether a criminal complaint has been filed or the Paris prosecutor has opened a case on the EFS incident. We found nothing as of 4 November, midday.

Checked on 4 November 2026: CERT-FR alert ALE-012 is unchanged since 16 October and does not mention the health sector. No new EFS or ministry statement, no Coolworld statement and no Paris prosecutor statement had been published.

Sources

• EFS communiqué, 3 November 2026, as quoted by franceinfo (Luc Chagnon, 4 Nov 2026, 11:08) and Next (Martin Clavey, 4 Nov 2026)
• Le Canard enchaîné, 3 November 2026 (paywalled; reported by Solutions Numériques, 4 Nov 2026, and L’Express via Orange Actu, 4 Nov 2026)
• Frédéric Pacoud, EFS, on BFMTV, 4 November 2026 (via L’Express)
• CERT-FR, CERTFR-2026-ALE-012, versions of 12, 13 and 16 October 2026
• Al Jazeera with AFP and Reuters, 4 Nov 2026; Euronews, 3 Nov 2026; ZDFheute, 3 Nov 2026; The Record, 3 Nov 2026; Infosecurity Magazine, 2 Nov 2026
• Claim of responsibility: Tg1 via Il Mattino and Open, 4 Nov 2026; Cybernews, 4 Nov 2026
• SentinelLABS, “Defrost and Disrupt”, 3 Nov 2026 (a company assessment, not an official one)
• Forescout Vedere Labs, 22 Oct 2026
• CISA and partners, AA25-343A, 9 Dec 2025
• Hybrid threats: EU JOIN(2016) 18; Hybrid CoE
• Attributed cases: SecurityWeek (Denmark, Dec 2025); CCDCOE (Norway); CNN (Poland, 17 Nov 2025)
• Plasma storage: ISBT, citing the EDQM Guide
• NIS2: Directive (EU) 2022/2555, Annexes I and II