"Today it was fridges, tomorrow it could be routers, the day after tomorrow it could be home appliances and so forth."
Supermarkets in at least twelve European countries were hit by cyberattacks in October and November, with France the worst affected, according to a report by SCMP World. Hundreds of French supermarkets were attacked on 11 and 12 October, with temperatures in refrigerators and freezers raised and entire inventories of perishable food thrown away. On Monday France said it held Iran's Islamic Revolutionary Guard Corps responsible.
Speaking in Brussels on Tuesday at the launch of ENISA's latest biennial report on the state of EU cybersecurity, the agency's executive director, Juhan Lepassaar, warned that the attacks on commercial refrigeration may be a prelude. "Today it was fridges, tomorrow it could be routers, the day after tomorrow it could be home appliances and so forth," he said. He argued that "security should not and cannot be an afterthought", and called on manufacturers to make products secure "by design".
Lepassaar would not comment directly on France's accusation against the IRGC. He said Iranian and Russian "state-aligned actors" were known to target Europe, pointing to "a lot of collaboration" between them, and named China, Iran and North Korea among state-aligned threat actors that target European companies and interests. The attribution of the supermarket campaign itself remains a national decision; the evidence behind Paris's conclusion has not been made public in the material available.
The ENISA chief framed the threat in terms of ordinary services rather than abstractions. Every service a citizen depends on, he said, contains "a layer whereby there is a digital element in it, a piece of code which, if not protected, can be hacked". A worst-case scenario would mean losing the services people rely on around the clock: "the policemen arriving, the fire brigade arriving, the hospital functioning, the transport giving you a ride from point A to B".
His remedy is money and regulation. "All incidents can be avoided, but the question is, are we ready to invest to make it happen? Cybersecurity is not cheap," he said. He welcomed EU cyber rules that will fully enter into force next year and plans to double the size of the Athens-based agency and its resources, though he conceded this would "never" be enough, calling it "a first good step".
The immediate significance is that the fridge attacks have moved cyber risk from data to physical operations: food spoiled, supply disrupted, and a national government naming a foreign military body. Whether the campaign marks a shift toward consumer devices, and whether Europe's coming rules and larger agency will deter it, are questions the report does not answer. What is confirmed is the pattern of attacks across a dozen countries and the French attribution; much else about the actors and their methods is not yet public.
