After recent attacks on supermarket fridges, home appliances could be next, the EU’s cyber chief warned on Tuesday, urging Europe to invest more to counter growing cyber threats.
The warning comes as Europe has been hit with numerous cyber incidents in recent months, raising widespread concern, not just from governments but from the public too, about how vulnerable society is to cyberattacks and how prepared the continent is to deal with future cyber threats.
“Security should not and cannot be an afterthought,” Juhan Lepassaar, executive director of the EU’s cybersecurity agency ENISA, told AFP.
“Today it was fridges, tomorrow it could be routers, the day after tomorrow it could be home appliances, and so forth.”
All incidents can be avoided, and cybersecurity is not cheap, Lepassar said, but the question he says is, ‘Are we ready to invest to make it happen?.
“When we look at the threats landscape, the picture is not so rosy,” Lepassaar stressed.
Recent incidents range from the PHP vulnerability, which prompted numerous EU governments to take down their websites to prevent exploitation by hackers, to the wave of cyberattacks on fridges at supermarkets and blood banks in France and eight other countries resulting from vulnerabilities in out-of-date software.
Cyber threats are evolving and becoming more visible, thanks in part to AI, and now require organisations to keep pace with the latest artificial intelligence model advancements in a kind of cyber arms race.
“Recent developments not only in frontier AI models but also cyber incidents in refrigeration systems across the EU underline the operational gaps and the need for timely information sharing and coordination,” said Lepassaar.
ENISA also calls AI a “force multiplier”, expanding and accelerating the ability of both hackers and the companies defending themselves to spot vulnerabilities more quickly.
“Data synthesised by researchers shows that the time between discovery and weaponisation is approaching zero,” says the report, suggesting that soon companies may have no time at all to protect themselves from vulnerabilities once systems are launched.
At the same time, the report says frontier AI is having a tremendous impact on vulnerability management by narrowing response and patch timings, meaning that companies can use AI to proactively check for vulnerabilities and address them before they are exploited by hackers.
Beyond AI being used as a tool by hackers to scout for vulnerabilities at scale, the report also highlights that AI will sharpen hackers’ existing weapons.
For example, AI tools allow attackers to carry out ever more convincing phishing operations using deepfake videos, audio and messages to trick people and “feed wrong data into systems to disrupt corporate operations”.
Factors driving cyber threats
The report found that 57.3% of cyber incidents in 2025 were ideologically driven by geopolitical events such as Russia’s war of aggression against Ukraine and the conflict in the Middle East, although most had limited impact.
Meanwhile, 29.3% of incidents were financially motivated, with ransomware remaining the most impactful incident type on businesses. The report warns that the ease with which criminals are able to share ransomware and other malware tools is “fuelling a professional criminal ecosystem”.
ENISA also notes that attacks resembling those orchestrated by state actors have been seen targeting European countries to conduct cyberespionage campaigns, collect intelligence and steal intellectual property.
Hacktivists, says ENISA, dominate reporting in terms of the volume of attacks, with most attacks being low-impact distributed denial-of-service (DDoS) operations.
Europe’s response
The EU has put in place myriad cyber rules to tighten up the bloc’s cybersecurity, but ENISA argues more can be done, and it’s hard to disagree given the recent wave of cyber incidents.
The pillar of Europe’s cybersecurity rules is the NIS2 Directive, which obliges all economic sectors to put in place digital safeguards to protect critical infrastructure. However, despite entering into application in October 2024, it hasn’t been transposed into law in all EU member states.
The recent attack on fridges in nine EU countries revealed that there are gaps in some economic sectors’ cybersecurity and in how they determine what is critical infrastructure.
Cybersecurity experts have said many businesses such as supermarkets view cybersecurity through a traditional lens, focusing on financial cybersecurity and leaving connected infrastructure in the hands of maintenance teams with different budgets and priorities.
There’s also the Cyber Resilience Act, which was adopted in 2024 and will be fully applicable in December 2027. It introduces reporting obligations through a single portal to speed up information sharing and coordination.
The Cyber Solidarity Act, which entered into force in February last year, strengthened the EU’s ability to detect, prepare for and respond to cybersecurity threats and incidents, says ENISA, through the creation of the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism and the EU Cybersecurity Reserve.
Europe’s response needs more AI experts
While Europe’s regulatory framework for cybersecurity is extremely busy, manning the defences is a glaring issue, says ENISA.
The report finds that across all sectors, organisations are struggling to attract and retain cybersecurity talent. It cites a 2025 NIS Investment study which found that 45% of organisations surveyed faced difficulties in finding professionals with the requisite cybersecurity skills.
The report warns that this could create a cybersecurity skills gap, giving wealthier organisations the advantage when competing for what is currently a limited pool of talent.
ENISA calls on member states to address the skills shortage by expanding activities and amplifying EU programmes in the cybersecurity field.