ENISA chief warns home appliances are the next hacking target

Lepassaar wants products to be secure from the design stage. Every incident can be prevented, he said, but security isn't cheap, and the question is whether manufacturers are ready to pay for it. ENISA's report also says AI is acting as a "force multiplier" that speeds up the hunt for vulnerabilities.

What happened to the refrigeration systems?

On the night of 11 to 12 October, refrigeration controllers at about 700 retail sites in France, supermarkets among them, were taken over remotely. Temperatures climbed, and at least 15 fires followed. Early this month, at least 12 countries, including Belgium, Sweden and Ireland, reported damage. The attackers got in through remote-management devices exposed to the internet and old equipment that never received security patches.

What the EU's Cyber Resilience Act requires

Under the Cyber Resilience Act, manufacturers have since September had to report actively exploited vulnerabilities and serious incidents within 24 hours of becoming aware of them. That covers products already on the market. Fines can reach 15 million euros or 2.5% of worldwide annual revenue, whichever is higher. Security-by-design requirements apply in full from December next year.

The pressure is already reaching South Korean makers that export connected appliances to Europe. An industry source said appliance security will become "a condition of market entry, not a cost," and pointed to three areas for investment: independent safeguards that protect temperature and power even if the network is breached, update policies that cover discontinued products, and tighter control of remote-management access. Seoul's science ministry has so far only recommended emergency steps such as using a VPN for remote access and changing default passwords.