Recent cyberattacks on refrigeration equipment in supermarkets across at least 12 European countries have raised alarms regarding the vulnerability of household appliances to hacking. On Tuesday, a senior official from the European Union’s cybersecurity agency warned that people’s domestic devices could be the next target for cybercriminals. He urged EU member states to significantly increase their security investments to combat the growing threats in cyberspace.
The Executive Director of the European Union Agency for Cybersecurity (ENISA), Juhan Lepassaar, delivered a stark message during the release of the agency’s latest biennial cybersecurity report in Brussels. He emphasized that cybersecurity must be a top priority and should not only be addressed retrospectively after an incident occurs.
Lepassaar pointed out the alarming trend, stating, “What is being attacked today are refrigeration units; tomorrow, it may be routers; and the day after, possibly household appliances.”
He further stressed that all cyber incidents are preventable, noting that the real issue is whether we are prepared to invest sufficiently to achieve this goal, as the cost of maintaining cybersecurity is not insignificant.
In early October, on the 11th and 12th, hundreds of supermarkets in France faced severe disruptions when their refrigeration systems were targeted by remote hackers. The temperature within many refrigeration and freezing units rose sharply, leading to spoilage of large quantities of goods, which forced supermarkets to dispose of entire stocks.
On Monday, November 9, the French government indicated that the attacks were orchestrated by Iran’s Islamic Revolutionary Guard Corps (IRGC). While Lepassaar did not directly address the accusations against Iran, he mentioned state-aligned threat actors from China, Iran, and North Korea, indicating that these entities have targeted various European organizations for potential attacks.
He warned that essential public services in modern society—such as water supply, healthcare, firefighting, law enforcement, and public transport—are highly digitized and crucial for daily living. If these services are not adequately protected, they could be compromised by hackers, which would severely impact the quality of life for citizens.
Moreover, the report noted that not only traditional Internet of Things (IoT) vulnerabilities pose a threat, but the rise of advanced artificial intelligence (AI) is further complicating Europe’s cybersecurity landscape. ENISA characterized cutting-edge AI as a “force multiplier” for hackers.
The report detailed how hackers utilize AI to automate the process of scanning for system vulnerabilities and launching attacks, significantly reducing the time between vulnerability discovery and exploitation. This timeframe can become “almost zero,” making it increasingly difficult for businesses to defend themselves or deploy necessary patches before they are breached.
Additionally, the report highlighted that hackers are not just utilizing AI for attacks but also employing deepfake technology to create more realistic audio and video for highly deceptive phishing schemes. This sophisticated approach aims to trick targets or cripple businesses’ operations.
Data from the report indicated that in 2025, 57.3% of cyber incidents were driven by geopolitical motivations, largely influenced by the Russia-Ukraine conflict and tensions in the Middle East. Meanwhile, 29.3% of incidents were attributed to economic motives, with the ransomware ecosystem expanding rapidly and becoming increasingly specialized.
In an effort to contain the growing crisis, the EU has intensified regulatory measures in recent years. The core framework is the revised Network and Information Systems Directive (NIS2 Directive), which came into effect in January 2023. Member states are required to transpose the directive into national legislation by October 2024, mandating all sectors of the economy to implement digital protection measures. The Cyber Resilience Act, set to be fully operational by December 2027, will establish a unified vulnerability reporting portal.
Furthermore, the Cyber Solidarity Act, effective since February of last year, has enabled the creation of a network security alert system, emergency response mechanisms, and reserve defense resources across Europe to enhance the capacity to respond to cybersecurity threats and incidents.
However, this comprehensive regulatory framework faces the significant challenge of a talent shortage in the cybersecurity field. According to research cited by ENISA from the 2025 NIS Investments project, 45% of organizations reported difficulties in recruiting professionals with the necessary cybersecurity skills. They warned that an insufficient supply of cybersecurity talent could undermine Europe’s long-term resilience in this domain.
In light of these challenges, ENISA has called for EU member states to allocate more resources towards recruiting talent, strengthening local skills training, and facilitating the influx of skilled professionals to address the pressing shortage of cybersecurity expertise.