EU cyber chief warns home appliances could be targeted after supermarket hacks

Juhan Lepassaar, executive director of the EU cybersecurity agency ENISA, told AFP in Brussels that manufacturers should build security into their products rather than treat it as an afterthought.

“Today it was fridges, tomorrow it could be routers, the day after tomorrow it could be home appliances and so forth,” he said. He called for more investment, while acknowledging that cybersecurity is expensive.

The attacks behind his warning targeted commercial refrigeration systems, not household appliances. Reuters reported that a wave of attacks on 2 November raised fridge and freezer temperatures at shops in eight European countries, forcing stores to throw away food.

France’s cybersecurity response team, CERT-FR, had earlier reported numerous compromises of remote controllers used in refrigeration installations. It advised operators of the affected systems to remove direct internet access, use protected connections and update their equipment’s firmware.

The EU’s Cyber Resilience Act sets security requirements for products with digital elements. Manufacturers’ reporting obligations began on 11 September 2026, while the law becomes fully applicable on 11 December 2027. Products already on the market are generally subject to its main provisions only if substantially modified after that date; the reporting obligations also apply to existing products.