The lesson from the EFS cold rooms…

During the night of November 1 to 2, 2026, a cyberattack targeting a service provider of the French Blood Establishment (EFS) remotely modified the temperature and defrost thresholds of cold rooms across three of its sites (Le Monde Informatique, 2026). No plasma bags were lost. The EFS's monitoring and alarm systems, independent of the provider's solution, detected the anomaly in time.

Three weeks earlier, the same mechanism had struck several hundred supermarkets. At an Intermarché store in Gradignan, the attack reportedly began around 11 p.m., and its consequences were not noticed until around 4 a.m. (InformatiqueNews, 2026). On November 9, France attributed this campaign to a unit of the Iranian Revolutionary Guard (Les Smart Grids, 2026). Same attack, two outcomes. The difference came down neither to the firewall nor to the password. It came down to a question that few manufacturers ask themselves: when the system controlling your process starts lying, who other than itself can raise the alarm?

A few figures to measure the cost of an unverified reading:

• 3 EFS sites affected, with rooms kept at –30 °C receiving a setpoint of 110 °C; this figure corresponds to the temperature requested of the machines, not an attained temperature (Clubic, 2026).

• Approximately 150 Intermarché stores affected according to the Les Mousquetaires group, and 80 confirmed Carrefour locations (InformatiqueNews, 2026).

• 6 hours: the duration during which certain equipment reportedly remained at 50 °C, according to statements made by Les Mousquetaires to Reuters (InformatiqueNews, 2026).

• 2,765 refrigeration controllers of a single model identified as accessible via the Internet by the Claroty Team82 research team, in a study published in August 2026 (InformatiqueNews, 2026).

• 11 European countries reported similar incidents following the French attack (Les Smart Grids, 2026).

Setpoint, alarm, monitoring screen: three voices, a single source

In a modern refrigeration facility, a central controller coordinates the regulators for each unit or cold room. It collects measurements, logs alarms, schedules defrost cycles, and allows settings to be modified via a simple web browser (InformatiqueNews, 2026). This single unit commands, measures, alerts, and displays. That is what makes it so convenient for the refrigeration technician who intervenes at night without traveling on site. It is also what makes it so dangerous the day it falls under someone else's control.

The attackers did not introduce any malicious function. They hijacked a perfectly legitimate function—defrosting—by raising its temperature to 50 °C and extending its duration from one to eight hours (InformatiqueNews, 2026). The controllers executed these commands without verifying their integrity (Les Smart Grids, 2026). And in certain stores, alarms were reportedly delayed by the parameter modifications (InformatiqueNews, 2026).

This is the core of the problem. An attacker capable of altering both operations and supervision can delay detection (InformatiqueNews, 2026). The setpoint changes, the alarm stays silent, the screen remains green.

The system does not break down. It lies.

Now transpose this to your own site. The curing oven in a composites workshop, the heat-treatment furnace, the aging cellar of a cheese dairy, the autoclave of an aerospace subcontractor: each is controlled by a PLC that sets the target, reads the probe, and triggers the alarm. If these three functions run through the same piece of equipment, they all fail together.

The technical takeaway: you are having your parts inspected by the operator who machined them, using their own caliper, with the zero set by themselves.

What the EFS did that the supermarkets did not

The EFS was not targeted directly. A service provider responsible for its refrigeration systems was compromised, and the press notes that such a breach can spill over to the client even when the client has its own security measures in place (Le Monde Informatique, 2026). In other words, the EFS's cybersecurity did not prevent the attack. It had no way of doing so.

What made the difference lay elsewhere. The alarms worked, an on-call technician noticed the temperatures rising during the night, and the systems were either brought back under control or shut down, their contents relocated as a precaution (Clubic, 2026). These alarms did not rely on the compromised solution.

An independent witness is defined by three separations.

• A separate measurement: the monitoring sensor is not the one regulating the process. It reads the physical value directly, without passing through the control PLC.

• A separate alert path: the alarm does not route through the equipment it monitors. If the central controller is compromised, the message still goes out.

• A separate administration: the witness system is not configured by the same service provider, using the same credentials, from the same portal. Otherwise, an attacker who gains access to one gains access to both.

The specialists interviewed after the supermarket attack say nothing different: autonomous temperature alarms, physical command restrictions, and recovery procedures that do not depend on the attacked supervisory system must be put in place (InformatiqueNews, 2026). High-risk industries have long applied this principle by separating the system that runs the process from the one that secures it. This must now be extended to any process where a drift destroys value.

"Our access points are closed": why the door is not enough

The objection is understandable. You have inventoried your access points, shut down exposed interfaces, and changed default passwords. The French governmental computer emergency response team (CERT-FR) pointed this out as early as October 12: exposing a management interface to the Internet goes against best practices (CERT-FR, 2026). We dedicated an entire article to this initiative, How many open doors are there in your workshop?, and it remains a priority.

However, closing the door reduces the probability: The witness reduces the consequence. These are two different layers of protection, and the former never excuses the absence of the latter, for three reasons.

• The first relates to the service provider: The EFS was compromised through a third party whose workstations and credentials it did not control. Your refrigeration technicians, system integrators, and machine manufacturers are in the exact same position.

• The second relates to the equipment: Updating an industrial controller can require a technician to travel on-site with a USB drive, and several affected models had been declared end-of-life years earlier (InformatiqueNews, 2026). A vulnerability window lasting several months is not an exception; it is the norm.

• The third relates to the adversary: The unit identified by France is known for targeting civilian infrastructure without issuing ransom demands (Les Smart Grids, 2026). They are not looking for your data. They are aiming for physical damage.

The real question is not whether your control system will one day be compromised. The real question is how long it will be able to lie to you before someone notices.

After securing the doors, and then the network discussed in Ten Hours Without Network, this third layer remained: the truth of the measurement.

4 concrete actions to implement an independent witness

1. Map who commands, who measures, and who alerts: list the processes where a deviation of a few hours destroys value, such as a curing batch, an oven load, or temperature-controlled inventory. For each, note which device sets the target, which reads the measurement, and which triggers the alarm. Wherever the answer is the same unit all three times, you have your priority.

2. Duplicate the measurement with a sensor outside the control loop: an autonomous data logger, a probe connected to a separate system, or a sensor based on an alternate technology. Its thresholds are set by you, not by the provider maintaining the installation.

3. Filter incoming commands, monitor those that change: an industrial security gateway can restrict communications to outbound monitoring traffic and block unauthorized incoming commands (Les Smart Grids, 2026). Any commands that still pass through must be monitored: a parameter change outside the normal range, outside working hours, or from an unusual IP address should trigger an alert before the temperature even begins to shift (Les Smart Grids, 2026). An eight-hour defrost cycle scheduled at 11 p.m. is not a routine maintenance setting.

4. Document manual override procedures: who travels on site, with which physical key, to shut down which piece of equipment, and where to relocate the contents. The EFS was able to regain control of its equipment or shut it down during the night. This procedure must be drafted calmly in advance, never at 3 a.m.

Allowing measurements to leave without letting arbitrary commands enter requires an intermediary that understands expected traffic patterns. This is the principle behind akawan's development of Kaptngo, a secure communication gateway designed to replace aging firewalls and hardware virtual private networks (VPNs). It supports machine-to-machine communications, legacy applications and protocols, license servers, as well as TCP and UDP protocols, with an initial requirement: adapting to business needs without disrupting existing systems. Positioned between field devices and the systems used for remote maintenance, it transforms the access pathway into an active control point rather than a mere open door. The functional scope can be found on the Kaptngo page, and our architectural approach on the Digital Transformation page.

A critical process deserves two witnesses

The cold room attacks mark a shift in nature. The attackers neither encrypted nor stole anything: they hijacked an ordinary operational function to cause physical damage, relying on the fact that the equipment running the process would also be the only one reporting on it. Where that monopoly existed, the drift went on for hours. Where it did not, the situation was brought under control within the night.

The target state is straightforward to state: for every critical process, one control command, one independent measurement, an alert that bypasses the monitored equipment, and a procedure to regain control without relying on it. None of this requires replacing your PLCs. All of it requires ending your exclusive trust in them. A single question is enough to evaluate your plant: if your PLCs started lying tonight, who in your organization would know before 4 a.m.?