France’s national blood service, Établissement français du sang (EFS), has confirmed a cyberattack affecting refrigeration equipment at three of its facilities after attackers compromised a third-party cooling equipment provider.
The incident occurred overnight November 1–2 and involved unauthorized changes to temperature and defrost settings in cold-storage systems used to preserve blood plasma.
According to French reporting, hackers attempted to change refrigeration settings from approximately -30°C (-22°F) to 110°C (230°F). While EFS confirmed that temperature and defrost thresholds were raised to extremely high levels, the actual temperatures inside the storage units were not confirmed.
Thankfully, its monitoring and alarm systems detected the anomalies and staff disconnected and secured affected equipment and moved blood products to other facilities before any blood products or samples were damaged.
Damon Small, Board Member, Xcape, Inc.
“This incident represents a troubling escalation in an ongoing campaign. Adversaries appear to be pivoting from disrupting food supplies in grocery stores to directly threatening patient care. We should expect these attacks to continue and potentially evolve from nuisance incidents into operations with much more harmful consequences.
“The fact that no group has claimed responsibility for these ongoing attacks in Europe and the United States is telling. This is not cyber vandalism; this is terrorism. As previously reported, the European countries targeted in this campaign share a common characteristic: they have all provided tangible support to Ukraine.
“Any device capable of affecting human safety that is connected to the Internet must have strong authentication and access controls. Access should be restricted to authorized users through appropriate filtering and security mechanisms. These systems deserve the same level of protection as any other critical operational technology.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security
“We’ve spent years telling organizations that third-party access is a security risk. This incident is a reminder that sometimes the consequences aren’t measured in stolen records or encrypted servers, but in degrees Celsius. And when we’re talking about blood plasma, that’s a very different kind of ransomware nightmare.
“From my experience in offensive security, what stands out isn’t simply that attackers reportedly manipulated refrigeration settings. It’s the architectural seam that allowed a compromise involving a third-party provider to affect systems responsible for maintaining critical medical supplies. That’s where the real security questions begin. What authority did that provider have? How was access controlled? Could those changes have been prevented or constrained before they reached the equipment?
“There’s also an important distinction between changing a temperature setpoint and changing the physical temperature. We shouldn’t confuse an attempted manipulation with a confirmed physical consequence. Fortunately, the reported monitoring, alarms, and staff response appear to have prevented damage.
“The lesson isn’t simply to secure the refrigerator. It’s to validate the entire chain of trust, from third-party access to operational controls, independent monitoring, and human intervention. Security isn’t what we assume the architecture will prevent. It’s what we can demonstrate the architecture will withstand when something goes wrong.”
Mark my words. This is just the beginning. More countries are going to be targeted. More environments are going to be targeted. Don’t let you be one of those targeted.
By the way, why do these even need to be on the Internet at all? Asking for a friend.
UPDATE: Aras Nazarovas, Senior Information Security Researcher at Cybernews said this:
“Refrigeration systems are just one example of equipment that can be controlled remotely and therefore compromised. Similar risks exist for heating and ventilation systems, water treatment facilities, pharmaceutical storage, and industrial machinery. If attackers gain access to these systems, they may be able to wreak havoc on other essential services or damage goods, without ever physically entering the attacked facility.”
Why do these attacks keep happening and how can organizations prevent similar attacks?
“Many organizations rely on third-party providers to remotely monitor and maintain their equipment. This may make maintenance easier, but it also means a potential entry point for hackers. If remote access isn’t properly secured, attackers may be able to use stolen passwords or software vulnerabilities to gain control of systems. And once they’re inside, they could change temperature settings just as a legitimate technician would. This is especially concerning when the same service provider manages equipment for multiple organizations – compromising one provider could potentially expose several customers.”
“To stay safe from these attacks, organizations should limit remote access to essential personnel and trusted suppliers, require multi-factor authentication, and keep control systems updated. It is also important to learn from such cases, with the attacks against France’s Blood Banks, they were able to quickly identify the attack and move the sensitive supplies to other, unaffected units. This highlights the importance of constant monitoring and having an actionable incident response plan, especially as these attacks start to become more common.”
Comparitech exposed an unprotected MongoDB database to the internet. It was wiped in 2 hours and 54 minutes
Posted in Commentary with tags Comparitech on November 5, 2026 by itnerdIn a study published today, Comparitech researchers detail the chain of events that occured after exposing an unprotected MongoDB database (containing 1K+ synthetic customer records) to the internet. The study breaks down the experiment — covering the time it took for the database to be entirely wiped, what sorts of attacks commenced, and more.
Commenting on the findings is Justin Schamotta, Researcher at Comparitech:
“The idea that an attacker chooses a particular company to target is a pervasive one, but a lot of attacks are far less selective. Rather than setting their sights on a particular organisation, they’re often looking for any system that presents an opportunity.
This typically involves scanning large portions of the IPv4 address space to see which ports are listening. For MongoDB, a scan would query port 27017. For MySQL it would use 3306, and for Redis it would use 6379. Scripts – which take seconds to put together with the help of an LLM – can automate this process and go a step further by querying the services behind those open ports to establish whether authentication is required. There’s no need for attackers to know who owns the database, what it contains or whether it’s particularly valuable. They simply find it, exploit it and move on to the next one.
Our experiment illustrates just how little time organisations have to get this right. It took just two hours and 54 minutes for someone to find our database, wipe its contents and leave a ransom demand. We also recorded five further instances of the same wipe-and-ransom behaviour during the 48 hours it was online.
Unless your database genuinely needs to be accessed remotely, there’s no reason to expose it to the public internet in the first place. Keep it on a private network, restrict access to trusted IP addresses and, crucially, enable authentication. This makes the difference between your database being invisible to attackers and becoming another easy target.”
For full details, the research can be read here: https://www.comparitech.com/news/we-exposed-an-unprotected-database-to-the-internet-it-was-wiped-in-2-hours-and-54-minutes/
Leave a comment »