Osegi
Security·2 min read

Hacked supermarket fridges: EU agency warns home appliances are next

After attacks on supermarket fridges in Europe, the EU cybersecurity agency says routers and household appliances could be the next thing hackers go after.

A row of refrigerators in a supermarket aisle, with a smart home appliance and router in the foreground symbolizing cyber risk.
Image: 01net.com

First it was supermarket fridges. Next it could be the washing machine in your kitchen. That is the warning from Juhan Lepassaar, executive director of Enisa, the European Union's cybersecurity agency, after several weeks of cyberattacks that hit European supermarkets and a handful of healthcare facilities.

"Today it was fridges, tomorrow it could be routers, and the day after tomorrow household appliances, and so on," he told AFP.

The worry is simple. Washing machines, ovens, robot vacuums and thermostats now connect to the internet, which means someone could try to take them over. Lepassaar says every service a citizen relies on has a layer of code in it, and that code can be hacked if it is not protected.

Christophe Bianco, head of cyber at Thales, made the same point at a press briefing a few days earlier. He has a connected robot lawn mower at home. Every such device, he said, widens the perimeter that has to be watched, and not all of them have been through a security check.

Who is behind the supermarket fridge attacks?

French authorities officially blame Shahid Kaveh, a cyber unit of Iran's Revolutionary Guards. Lepassaar declined to comment on that attribution. He did say that Europe is targeted by several foreign powers, naming China, Iran and North Korea, and the actors aligned with them.

The attacks are not limited to Europe either. The FBI has warned of "systems targeted around the world", including industrial refrigeration and cold-chain monitoring systems.

What is Europe doing about it?

The EU is counting on the Cyber Resilience Act, which puts security obligations on makers of connected devices and takes effect next year. Lepassaar says "all incidents can be avoided", but the real question is whether we are ready to pay for it. "Cybersecurity is not cheap," he said.

He also pointed to the services that could be knocked out in a worse scenario: police and firefighter dispatch, hospitals and transport. If those stop working, he said, the impact would be immediate.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:enisacyberattacksmart homeiotcyber resilience actfbi

More from this day

See all →

More in: Security

See all →