A major healthcare security organization has issued an urgent warning after cyberattacks targeted refrigeration controllers, including a breach that threatened temperature-sensitive supplies at a French blood bank. The advisory, released in a security bulletin by the Health Information Sharing and Analysis Center (Health ISAC), highlighted how operational technology (OT) attacks against specific refrigeration equipment brands directly intersect with emerging physical threats to patient safety across the health sector. Operational technology refers to the machines controlling real-world physical processes, ranging from water pumps to industrial cooling systems.
Recent months have seen widespread headlines over cyberattacks targeting refrigeration controllers in grocery stores and food processing plants across Europe, Israel, and U.S. military bases. Those intrusions resulted in major business disruptions, spoiled food, fires, and broken machinery as attackers actively took advantage of system vulnerabilities. However, until news emerged that the French blood bank, known as the French Blood Establishment (Établissement Français du Sang), was targeted, far less public attention was focused on the severe risks of failing refrigeration controllers in healthcare, where vaccines, plasma, and blood require finely tuned temperature-controlled environments to remain viable.
In an email, Errol Weiss, the chief security officer at Health ISAC, stressed that healthcare cybersecurity is fundamentally about patient safety. Weiss explained that when threat actors manipulate operational technology like cold-chain storage and refrigeration units holding donor blood, plasma, or critical therapies, they are not merely stealing data or locking down administrative files, but directly endangering the physical resources required to sustain human life.
The rising danger prompted a joint response on Thursday from four U.S. government entities: the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), and the U.S. Department of Agriculture (USDA). The agencies published a fact sheet addressing cyber threats to industrial refrigeration and cold-chain monitoring systems, which are critical across healthcare, chemical production, food and agriculture, and transportation. Brett Leatherman, director of operations for the FBI Cyber Branch, stated that the bureau is tracking bad actors targeting these systems across critical infrastructure sectors globally, putting inventory and equipment at risk. Leatherman noted that industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors.
The French Blood Establishment confirmed in a press release on Tuesday that a third-party vendor supporting its cold storage rooms was targeted by malicious cyber activity. The breach caused defrost settings and temperature thresholds to be raised dangerously high. However, the organization managed to detect the suspicious activity in time to rescue stored blood samples before they were ruined.
Authorities note that it remains unclear who is responsible for the broader global attacks on refrigeration controllers or whether single or multiple threat groups are involved. Earlier in the spring, Iran was linked to at least one complex incident in Israel that involved higher sophistication and malicious activity. Investigators probing disruptions at U.S. military bases are also examining Iran as a potential culprit.
Meanwhile, two pro-Russian hacking collectives, NoName057(16) and Z-Pentest Alliance, belatedly posted on Telegram and released videos claiming responsibility for cold-chain attacks across Europe. The groups published alleged hacked credentials that would allow access to equipment, including machines manufactured by Danish firm Danfoss and American company Copeland, which control temperature and monitoring functions. Although both hacking groups have a history of targeting refrigeration controllers and operational technology, cybersecurity experts remain skeptical of their claims because it is unclear whether the recent European attacks even required stolen credentials to execute. Tom Hegel, who leads threat intelligence research at cybersecurity firm SentinelOne, explained that making clear assessments requires deeper forensic evidence, such as access logs, configuration changes, and connections between maintenance accounts on controllers. "It's important to note that such Russian threat actors often seek attention and claim to cause incidents even when false," he continued.
Regardless of attribution, the wave of attacks highlights deep vulnerabilities in ubiquitous remote management tools. In France alone, thousands of refrigeration controllers were directly exposed to the open internet with almost no protection before unidentified hackers targeted them in October, and experts continued tracking hundreds of unprotected devices afterward. This represents only a fraction of tens of thousands of exposed operational devices online across global critical infrastructure. Security firm Claroty published research uncovering security vulnerabilities in major remote management controllers, including models made by Copeland and Danfoss, after notifying the manufacturers.
While vendors have created software patches for certain vulnerabilities, patching operational technology remains difficult because process updates often require shutting systems down. In healthcare, even minutes of system downtime create extreme risks for patient safety. For aging models, patching is impossible because manufacturers no longer provide updates, and organizations cannot afford new equipment. Additionally, facility executives sometimes do not even know what machines exist on their networks. Additionally, for many companies, vendors that work with them demand remote access to systems like refrigeration controllers to regularly service them. It's often a requirement in the contract companies sign. Nic Adams, CEO of U.S. offensive security firm 0rcus, explained that industrial chillers operate under commercial vendor agreements mandating persistent remote access, leaving national food and medical supplies defenseless against basic credential abuse.
Finally, hackers are now using AI to find these vulnerabilities faster than ever, and AI is also helping them to better understand the complex machines and the processes they control. Bad actors a world away no longer need to understand individual languages or industries, or even the physics involved to disrupt operations. In recent weeks, cyber incident responders report seeing a massive spike in attacks carried out at least in part by AI agents. Fortunately, experts emphasize that many of these intrusions are not particularly stealthy, novel, or sophisticated.
Weiss noted that preventing opportunistic attacks begins by eliminating public internet exposure, enforcing strict network segmentation to isolate refrigeration systems from standard enterprise and guest networks, and implementing safeguards that software overrides cannot bypass, such as hard-wired mechanical cutoffs and independent thermal alarms. The Health ISAC alert urges industry operators to separate not just refrigeration controllers from hospital IT systems, but also medical gas monitors, while training staff onsite to take physical manual control of machines in an emergency. Finally, the alert urges hospitals to have offline backups of their systems.
Timely intelligence sharing has already averted major damage in Europe. When Estonian grocery chain Selver was attacked on November 2, hackers managed to alter a store's refrigeration temperature setting to +50°C. Annika Müür, spokesperson for Estonia's Information Systems Authority (RIA), said managers were on high alert due to prior agency warnings, allowing the service provider to react quickly and prevent significant damage. Müür emphasized that while attacks were not prevented entirely, the case demonstrates the importance of monitoring international threats, acting on early warnings, and working closely with businesses. Weiss agreed, writing that rapid, trusted cross-border information sharing is the strongest collective defense, allowing health facilities globally to recognize attack patterns, verify vendor exposure, and harden critical infrastructure before threat actors cause physical harm.
A close up of the hands of a nurse from the French Blood Establishment checking the identification and traceability of blood samples beside a donor during a mobile blood donation session in Paimpol Cotes d Armor Brittany France on July 23, 2026. Helene Rigny/Hans Lucas/AFP via Getty Images hide caption
