France Attributes Cyberattack on Blood Bank Cold Storage to Iran’s IRGC
France has formally attributed a cyberattack that disrupted cold storage at French Blood Establishment (EFS) facilities to Iran’s Islamic Revolutionary Guard Corps (IRGC). The attack targeted a third-party refrigeration equipment provider. It sent storage temperature settings soaring to dangerously high levels, in the latest of a wave of attacks on European cold storage systems.
What happened
On November 2, 2026, attackers took over cold storage monitoring and control systems at three EFS blood storage facilities. Temperatures were pushed toward 110°C instead of the normal operating temperature of -30°C, putting blood and plasma supplies at risk of degradation. The Bourgogne-Franche-Comté region was among the worst affected.
EFS said it was not the direct target. In its statement, the blood service said that “several regional facilities” were affected by an incident that impacted certain cold storage room monitoring and control systems.
The supplier: Coolworld Rentals
EFS did not name the affected supplier, but European refrigeration provider Coolworld Rentals has disclosed that several of its storage units were affected. Coolworld said only a limited number of its units were hit and that it responded promptly. According to the company, the attack affected a third-party storage component it uses to manage customers’ products. Coolworld said the vulnerability was outside its direct control.
Vulnerable components
Some of the affected blood banks used one of two vulnerable components:
| Component | Vulnerability | Description |
|---|---|---|
| Obsolete Danfoss refrigeration component | CVE-2025-41450 (CVSS 8.2, High) | Authentication bypass |
| Copeland/Dixell XWEB controllers | CVE-2025-41451 | Improper authentication |
Attribution: Iran’s IRGC
No threat actor has claimed responsibility. However, French Foreign Minister Jean-Noël Barrot said he could confirm that responsibility lies with the IRGC.
The attribution follows warnings from French officials. In October 2026, ANSSI Director General Vincent Strubel told a French Senate hearing that the ongoing wave of cyberattacks on cold storage units could affect the healthcare system. Jamie Moles of ExtraHop described the attacks as cold-chain sabotage escalating from retail disruption to essential lifelines, such as blood banks. Earlier in the campaign, supermarket refrigeration systems were forced into continuous heating cycles.
No health impact
EFS said its monitoring and alarm systems quickly detected the anomalies, so staff could act before any blood products or samples were compromised. As a precaution, samples were moved to other blood banks. Coolworld confirmed that no health impact has been identified and no loss of blood products has been reported.
Response and investigation
EFS is working with France’s national cybersecurity agency (ANSSI) and the Ministry of Health to keep blood banks running normally. It has also added measures to monitor and control temperatures in its cold storage units. The Ministry of Health has opened an investigation to determine the source of the attack.
We will update this post as the French investigation progresses.
