EU Cyber Chief Warns Home Appliances Could Be Next Targets Following Supermarket Hacks

POLICY WIRE — Brussels, European Union — — The European Union’s lead official on cybersecurity warned on Tuesday that home appliances may be the next frontier for hackers following recent security breaches at supermarket refrigerators.

This urgent alert arrives as a wave of cyber incidents across the continent has sparked deep concern among government officials and the public regarding Europe’s vulnerability to sophisticated digital assaults.

Juhan Lepassaar, the executive director of the EU cybersecurity agency ENISA, emphasized that digital security can no longer be treated as a secondary concern.

Lepassar noted that while refrigerators were the focus today, routers could follow tomorrow, with home appliances potentially becoming primary targets in the near future.

While many of these incidents are preventable through proper protection, Lepassar raised the critical question of whether Europe is prepared to invest in the necessary defenses.

Reflecting on the current threat landscape, the agency director described the outlook as being far from optimistic.

Recent attacks have ranged from PHP vulnerabilities that forced several EU governments to take websites offline to targeted strikes on supermarkets and blood banks in France and eight other nations, largely caused by outdated software.

Lepassaar pointed out that cyber threats are evolving and becoming more visible due to advancements in artificial intelligence, requiring organizations to keep pace in a growing digital arms race.

ENISA also views AI as a “force multiplier” that accelerates the speed at which both attackers and defenders can identify security weaknesses.

Data synthesized by researchers suggests that the window of time between a vulnerability being discovered and being weaponized is approaching zero, meaning companies may soon have no time to implement protections once systems are live.

Beyond being used to scout for weaknesses at scale, the report highlights that AI is sharpening the arsenal of hackers.

For instance, attackers are utilizing AI tools to execute increasingly convincing phishing operations using deepfake video and audio to trick individuals into feeding fraudulent data into corporate systems.

The report found that 57.3% of cyber incidents in 2025 were driven by geopolitical events, such as the Russian war against Ukraine and conflicts in the Middle East, though most had a limited impact.

Meanwhile, 29.3% of incidents were financially motivated, with ransomware remaining the most damaging type of attack for businesses.

The agency warns that the ease with which criminals share ransomware and other malware tools is fueling a professional criminal ecosystem.

ENISA also noted attacks resembling state-sponsored campaigns targeting European countries to conduct espionage and steal intellectual property.

According to the agency, hacktivism dominate the volume of attacks, most of which consist of low-impact distributed denial-of-service (DDoS) operations.

While the EU has introduced various regulations to bolster its collective defense, ENISA argues that more action is required given the recent frequency of incidents.

A pillar of this strategy is the NIS2 Directive, which requires various economic sectors to implement digital safeguards for critical infrastructure; however, despite starting in October 2024, it has not been transposed into law by all member states.

The recent refrigeration attacks in nine EU countries revealed gaps in certain sectors regarding how they define critical infrastructure.

Security experts observed that many businesses, like supermarkets, view cybersecurity through a traditional lens, leaving connected infrastructure to maintenance teams with inconsistent budgets and priorities.

Additionally, the Cyber Resilience Act, adopted in 2024 and set to be fully applicable by December 2027, introduces reporting through a single portal to accelerate coordination and information sharing.

The Cyber Solidarity Act, which came into force last year, strengthened the EU’s ability to detect, prepare for, and respond to threats through the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism, and the EU Cybersecurity Reserve.

While Europe’s regulatory framework is extensive, ENISA stated that staffing these defenses remains a glaring issue.

The report indicates that organizations across all sectors are struggling to attract and retain talent, citing a 2025 NIS Investment study which showed 45% of surveyed entities faced difficulty finding professionals with the necessary skills.

The agency warns this could create a skills gap that gives wealthier organizations an advantage in the competition for a limited pool of talent.

ENISA is calling on member states to address this shortage by expanding activities and amplifying programs within the field of cybersecurity.

Reporting by Policy-Wire (PW)