Hackers Just Took Europe's Blood Fridges: Cold Chain Is Now Critical Infrastructure and No One Owns the P&L

The path in was physical. A cyberattack hit the refrigeration contractor serving France's national blood service, and the supervision and control installations for cold rooms at three sites had their temperature and defrost thresholds pushed to very high levels. Rooms that normally sit at minus 30 degrees were programmed to climb toward 110, and what they held was blood products, plasma bags destined for transfusion and for medicine manufacturing, plus biobank samples.

EFS says it was not the intended target and that the route ran through a third-party refrigeration provider. The blood service's own monitoring and alarm systems identified the anomalies quickly, affected equipment was either brought under control or neutralised, and stored product was transferred to other sites preventively. The loss was zero because someone was watching the temperature, not because the equipment was secure.

Forescout's Vedere Labs counted 12,976 internet-exposed refrigeration service observations across 6,017 public addresses in 99 countries and territories, spread over ten product families. The concentration is extreme: Copeland and Dixell's XWEB supervisory platform accounts for 7,075 exposed services, Danfoss StoreView for 4,697, and no other vendor family exceeds 551.

Two weaknesses explain why no malware was needed. First, authentication: of 513 exposed Carel pCOWeb endpoints, only 287 returned an authorisation challenge at all. Second, stale firmware on hardware nobody can patch. An estimated 3,762 of the exposed Danfoss endpoints, 80% of that family, run firmware older than 4.3.1, the level that fixes the 2025 CVEs affecting the AK-SM 800A, and the AK-SM 800 itself has been end-of-life since May 2021.

The attack surface is not exotic. Danfoss provided the supervisory system ICA uses in Sweden, some Co-op cabinets in France were reachable over 4G mobile networks, and Belgium's Sabcobel began patching cabinets after the October wave, which limited how far the damage spread. Meanwhile Forescout has tracked more than 20 claimed attacks on refrigeration systems since January, with one group claiming ten of them on a single day in April.

Forescout's researchers also flag the exposure explicitly for hospitals and pharmaceutical sites, not only for food retail. The vulnerable fleet is the same fleet that sits behind blood banks, vaccine stores and hospital pharmacy refrigerators, and nothing in the European attack waves was specific to supermarkets.

Nobody has priced this loss, because the insurance market is structured to exclude it from both directions. Lockton, the broker that placed specialist cover after the October attacks, notes that nearly all property policies exclude losses caused by cyber events, while conventional cyber policies typically exclude physical damage and the business interruption that follows. The spoiled stock falls between two policies that each assume the other has it.

The first claims evidence is already arriving. Intermarché, part of Les Mousquetaires, told AFP its insurance did not cover this type of incident, and Thierry Cotillard, the group's president, put the nationwide cost at tens of millions of euros. Coverage for cyber-caused spoilage exists, but it is a new product with thin capacity, not an extension of what policyholders already buy.

Regulators have started to close part of the gap, but only the reporting half. Since Sept. 11, 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting products with digital elements: an early warning within 24 hours, a full notification within 72 hours, a final report within 14 days of a corrective measure for exploited vulnerabilities, and a final report within a month of the 72-hour notification for severe incidents, all filed through ENISA's single reporting platform.

What that does not do is make anyone fix anything. ENISA told The Record that reporting obligations continue to apply to end-of-life products still in use, while the duty to fix issues and issue free security updates applies only during the manufacturer's support period. Controllers placed on the market before December 2027 are therefore not required to be remediated, and the revised Product Liability Directive does not reach back to existing equipment. Europe now mandates disclosure of an exploit while leaving the unpatchable hardware in place, which converts a silent liability into a documented one without converting it into a controlled one.

Losses land on the balance sheet that holds the most refrigerated product for the longest time, which is not the medical distributor. Distributors turn inventory in weeks: McKesson carried 23 days of inventory and Cardinal Health 26 days in their latest fiscal years, and both run gross margins near 4%, so a spoiled batch is a rounding error against revenue but a visible hit to operating profit.

Fractionators are the opposite. Grifols carried 259 days of inventory at a 4.9 times net leverage ratio, GC Biopharma 224 days at 6.0 times and a 26.9% gross margin, Takeda 231 days, and Shanghai RAAS 420 days of inventory against a 10.1% revenue decline in 2025. Between 224 and 420 days of plasma-derived product is a cold chain that no policy currently covers, and that is where an unpriced loss would land.

For US investors the transmission is narrower than the headlines suggest and more specific. McKesson's Plasma and Biologics operation distributes plasma-derived products, biologics and specialty therapies to health systems and specialty pharmacies with 99.8% pack-out accuracy and next-day delivery across the country. Cardinal Health's nuclear pharmacy network dispenses 12 million patient-specific radiopharmaceutical doses a year, reaching 95% of hospitals within three hours, and plans to invest more than $150m over three years expanding its cyclotron network for PET products.

Those are the two listed operations where a refrigeration compromise converts directly into clinical supply failure rather than into a margin problem. A radiopharmaceutical dose cannot be replaced from a warehouse, and a delayed plasma shipment is a missed dose date, not a delayed box.

The reason this has produced no earnings event anywhere is that the exposed control layer is not held by listed companies. Danfoss and Carel are privately held. Copeland, the owner of the XWEB platform behind 54% of all exposed services, was Emerson's Climate Technologies business until Blackstone funds took a majority stake in May 2023, and Emerson then sold its remaining 40% non-controlling interest to those funds for $1.5bn in August 2024, taking equity-method losses of $125m and $177m in the two prior years.

Refrigeration hardware itself sits in a similar gap. Thermo Fisher Scientific sells the Thermo Scientific TSB series of blood bank refrigerators built to AABB requirements, but the controller and supervisory layer inside or beside those cabinets is what was exploited. So the replacement cycle that this attack wave creates has no listed home, and the liability it creates sits with sponsors and private firms that do not publish the numbers.

The downstream list is long and mostly private or public-sector, which is precisely why the loss is unowned. A national blood service, its contractor, a set of supermarket chains, a Dutch group that also runs Stop & Shop and Giant Food in the United States, UK food suppliers, hospital blood banks, and every plasma collection centre in Europe, Asia and the Americas all sit inside the same exposed controller estate.

Against that, the listed beneficiaries are the companies that sell proof and the companies that sell the new policy. Haemonetics sells the blood bank information system, SafeTrace Tx, that records which unit of product came from which donor, and it also sells the plasma collection platforms that generate the product. Chubb and peers write the emerging cyber property damage and spoilage class; Willis Towers Watson's cyber practice is already working the claim-wording questions raised by the French cases.

One more thing makes this a services story rather than a hardware story. The UK cyber security centre's assessment that an AI-powered ransomware strike on critical infrastructure is highly likely within two years means the controllers are the easiest entry point for the next wave. Detection and verification are the products that scale with the threat, because the hardware replacement cycle is finite and the attacker population is not.