EU Cyber Agency Warns Home Appliances Could Be Next After Fridge Attacks

Juhan Lepassaar, executive director of the European Union Agency for Cybersecurity, said on November 10, 2026 that home appliances could become the next targets after a series of attacks on supermarket refrigeration in Europe. His remarks, reported on November 11, accompanied the release in Brussels of the agency's latest biennial report on the state of the bloc's cybersecurity. He called on manufacturers to design products that are secure from the outset and on governments to commit more money to defenses.

Supermarkets in at least 12 European countries were hit by cyberattacks in October and November, with France the most heavily affected. Reports also linked the incidents to refrigeration systems at blood banks. Lepassaar said that the attacks exposed weaknesses in outdated software and that the same kind of exposure could reach routers and everyday household equipment.

What the agency's report found

The report says the EU's overall cybersecurity posture has improved, with the bloc scoring 71.53 out of 100 on the agency's Cybersecurity Index. ENISA added that the wider ecosystem remains in flux and that most member states have reached a mature posture level or higher. Regulatory compliance was named as the main reason critical sector organizations invest in cybersecurity, a driver cited by 70 percent of those surveyed.

France has accused Iran of involvement in the fridge incidents, and Tehran has rejected those accusations as baseless. Lepassaar stopped short of commenting on the French claim, but he said that Iranian and Russian state-aligned actors are known to target European systems. He argued that the cost of protection is real, yet that incidents of this kind can be prevented if buyers and providers choose to pay for it.

The agency also pointed to a shortage of qualified people. It cited a 2025 study in which 45 percent of organizations surveyed reported difficulty finding staff with the required cybersecurity skills. ENISA is urging member states to put more resources into training and to expand programs that prepare the next generation of security specialists.

Rules that shape the work

The EU's NIS2 Directive requires organizations across all economic sectors to put digital safeguards in place to protect critical infrastructure. The Cyber Solidarity Act, which entered into force in February of last year, created tools for detecting and responding to threats, including a European Cybersecurity Alert System and an EU Cybersecurity Reserve. ENISA is also running the reserve under a contribution agreement with the European Commission, backed by EUR 36 million.

For workers, the episode highlights a gap between IT security teams and the maintenance crews who often run refrigeration, building and other connected equipment. Commentators quoted by news outlets have said many businesses, including supermarkets, have focused on financial cyber risks while leaving connected infrastructure to teams with separate budgets and priorities. That gap suggests rising demand for staff who understand both operational technology and software security, as well as for people who can handle incident response.

Looking ahead, the Cyber Resilience Act's main requirements will apply from December 11, 2027, which gives manufacturers of connected products a defined timetable to meet secure-by-design obligations. Observers will watch whether member states complete their investigations into the refrigeration incidents, whether France's accusations lead to formal findings, and how quickly companies that run cold chains and medical storage adjust their budgets and staffing.