How vulnerable is our everyday life to the growing threat of cyberattacks? Recent incidents across Europe, where hackers remotely took control of supermarket refrigeration systems, offer a glimpse of how a malicious digital attack can disrupt things we have taken for granted for decades.
Cyberattacks are no longer confined to stealing personal data, committing online fraud or breaking into computer networks. They can now directly affect essential infrastructure and services that have become fundamental to modern life.
Phileleftheros speaks to Marios Tziapouras, Director of Cybersecurity at the Deputy Ministry of Research, Innovation and Digital Policy, and Communications Commissioner Marios Pieris about the risks facing Cyprus and the measures being taken to protect the country.
Tziapouras is responsible for cybersecurity policy at the technical level within the Republic of Cyprus, while Pieris oversees and supervises cybersecurity through the Digital Security Authority (DSA).
It started in France
The attacks on supermarket refrigeration systems began on 12 October, when approximately 700 supermarkets across France were targeted in a coordinated cyberattack.
In simple terms, the attackers gained access to refrigeration control systems and remotely activated their defrost functions overnight.
The attack caused refrigerators and freezers to overheat, resulting in substantial food losses and, in some cases, fires.
Supermarket employees were forced to throw away large quantities of spoiled food, including meat and melted ice cream, filling enormous waste containers with products that could no longer be sold.
The company behind many of the affected refrigeration units said several were ageing systems or operated with outdated software, potentially making it easier for hackers to gain access.
The financial damage could reach tens of millions of euros nationwide, according to an estimate by a French supermarket owner.
A second wave spreads across Europe
On 2 November 2026, another wave of similar incidents was reported in at least nine European countries: Belgium, Sweden, the Netherlands, Estonia, Ireland, Finland, Luxembourg, Portugal and Italy.
The attacks even targeted refrigeration equipment used by French blood banks, forcing employees to transfer some blood supplies to alternative cold-storage facilities.
In Sweden, a supermarket manager in Stockholm told Reuters that freezer temperatures had reached 50°C, destroying the products inside.
Cyprus issues preventive cybersecurity warning
On 7 November, Cyprus’s Digital Security Authority issued an alert urging businesses across the country to take preventive measures in response to an ongoing campaign of cyberattacks targeting operational technology and industrial control systems (OT/ICS) in European Union member states.
The authority said the European incidents appeared to involve attackers exploiting legitimate functions of control systems accessible through the internet.
In many cases, those systems were protected by default or weak login credentials.
Similar automation, telemetry and control technologies — including supervisory control and data acquisition systems (SCADA), building management systems (BMS) and programmable logic controllers (PLC) — are also used in Cyprus.
The DSA therefore called on all essential and important entities to immediately review their systems and introduce the necessary safeguards.
Its main recommendations included:
- Restricting remote access to secure VPN connections protected by multi-factor authentication (MFA).
- Changing default or weak passwords.
- Updating system software and firmware.
- Separating information technology (IT) networks from operational technology (OT) networks.
- Continuously monitoring system operations and temperatures, with an incident response plan in place.
The authority said it was closely monitoring developments and remained in contact with relevant national and European bodies to assess the threat, exchange information and strengthen protection for Cyprus’s infrastructure and businesses.
Communications Commissioner Marios Pieris stressed that protecting critical digital and industrial infrastructure is a shared responsibility and a central pillar of the country’s cyber resilience.
The authority clarified, however, that its warning was precautionary and did not indicate that a similar incident had occurred in the Republic of Cyprus.
French authorities point to Iran
On 9 November, French authorities attributed the October attack to the Shahid Kaveh cyber operations unit, which they link to Iran’s Islamic Revolutionary Guard Corps.
French intelligence and cybersecurity agencies said they had identified similarities between the digital infrastructure used in the attacks and earlier operations associated with the group.
Their findings included the use of specific tools designed to identify industrial systems, references to online networks linked to the group and traces of Persian-language content.
Particularly concerning was the finding that the attacks extended beyond supermarket refrigeration and food industry systems.
According to the same report, equipment at small hydroelectric facilities in France was also targeted.
The French government described the attack as unprecedented in scale and aggressiveness and announced that it would seek new European sanctions against Iranian individuals and organisations.
However, the official attribution covers only the October attacks in France. Authorities have not confirmed that the same group was responsible for the subsequent incidents in other European countries.
European Commission promotes 72-hour emergency preparedness
Earlier this month, the European Commission introduced new guidance aimed at improving public preparedness for emergencies and crises.
Cyberattacks are among the threats addressed, reflecting their growing potential to disrupt services essential to daily life.
The guidance builds on the EU Preparedness Union Strategy, adopted in March 2025, which seeks to strengthen Europe’s resilience to natural disasters, geopolitical crises, hybrid threats and cyberattacks.
A central recommendation is for households to prepare an emergency kit containing enough essential supplies to meet their needs during the first three days of a crisis.
The advice is particularly relevant to modern cyber threats, as a large-scale attack could potentially disrupt electricity, water supplies, telecommunications or other essential services.
What should a 72-hour emergency kit contain?
The Commission does not prescribe a single mandatory list of supplies. However, the suggested items include:
- Drinking water and non-perishable food that does not require refrigeration or cooking.
- Regular medication and a first-aid kit.
- A torch, spare batteries and a battery-powered radio.
- A mobile phone, charger and fully charged power bank.
- A small amount of cash in case electronic payments become unavailable.
- Copies of identity cards, passports and important documents kept in a waterproof pouch.
- Personal hygiene supplies, including hand sanitiser, tissues and wet wipes.
- A change of clothes, warm clothing and an emergency blanket.
- A whistle, multi-tool and spare keys.
- Additional supplies for babies, elderly people, people with disabilities or pets, depending on individual needs.
Marios Pieris: When cyberattacks reach supermarket shelves
Office of the Commissioner of Communications: Marios Pieris and Georgios Georgiou officially assume duties
“Over the past few weeks, Europe has experienced an unprecedented phenomenon. In October, unknown attackers gained access to the refrigeration control systems of hundreds of French supermarkets and raised the temperatures of refrigerators and freezers overnight. The result was tonnes of spoiled food and, in some shops, fires.
“On 2 November, a second wave followed, affecting supermarkets in more than ten other European countries. The positive news is that no similar incident has been reported in Cyprus so far.
“The Digital Security Authority is closely monitoring developments, maintaining constant contact with its European partners and is ready to respond immediately if necessary.
“We are better prepared today than ever before. With the implementation of the European NIS2 Directive on cybersecurity measures in Cyprus, the number of critical entities under supervision has increased from approximately 70 to around 500.
“Through European cooperation networks, we also receive early intelligence about threats detected elsewhere, often before they reach us. But preparedness is not solely the responsibility of the state.
“These incidents teach us two things. First, cybersecurity is no longer just about data. It also concerns the physical world: the food we buy, public health and the safety of facilities.
“Second, these attacks did not require advanced techniques. The attackers exploited systems exposed to the public internet, many of which had default or weak passwords.
“We will see incidents like these increasingly often, and I want to emphasise that these were not highly sophisticated attacks. The systems were simply vulnerable. They could have been secured relatively easily, but evidently that had not been done.
“Connecting devices to the internet is not, in itself, a problem. The problem is connecting them without proper controls and the necessary security measures.
“I therefore urge everyone operating such systems, not just supermarkets, to take the following measures immediately:
- Do not leave control systems exposed to the public internet. Allow remote access only through secure, controlled connections.
- Change all default passwords, introduce multi-factor authentication and install available security updates.
- Separate information technology (IT) networks from operational technology and Internet of Things (IoT) networks.
- Ask suppliers and maintenance providers to confirm which security measures they have implemented.
- Set up alerts for unauthorised changes and ensure systems can be controlled manually, with an incident response plan in place.
“Finally, I want to emphasise that security is everyone’s shared responsibility. The authority provides guidance and supervision, but each organisation is its own first line of defence.
“Anyone who detects suspicious activity can report it immediately to CSIRT-CY on 1490 to receive guidance. Early reporting can prevent damage.”
Marios Tziapouras: Cybersecurity is a matter of national security
“The recent cyberattacks on supermarket refrigeration systems in European countries demonstrate just how directly a digital threat can affect the operation of markets, people’s daily lives and the wider economy.
“The more devices and infrastructure we connect, the more opportunities we create for malicious activity.
“At the same time, attacks are becoming more frequent and sophisticated, while artificial intelligence is making advanced tools more accessible and increasing attackers’ capabilities.
“In response, the European Union is developing a comprehensive cybersecurity framework through initiatives such as the Cybersecurity Act, the NIS2 Directive, the Cyber Resilience Act and the Cyber Solidarity Act.
“These measures strengthen protection for critical infrastructure, businesses, digital products and services.
“Cyprus has already aligned its national framework with the NIS2 Directive, strengthening cybersecurity requirements across more sectors of the economy, including the food supply chain.
“For the government, cybersecurity is a matter of national security, economic resilience and protecting citizens.
“Digital progress depends on trust and reliable services. That is why we are investing in a comprehensive approach, from prevention and early detection to effective incident management and rapid recovery.
“Our central objective is to ensure that essential services continue operating even when an attack takes place.
“This commitment is also clearly reflected in the state budget under the current administration. For the first time, a dedicated cybersecurity allocation of approximately €10 million annually has been included for three consecutive years.
“We place particular emphasis on protecting critical infrastructure and services, preparedness exercises and cooperation between the competent authorities, operators and our European partners.
“The government is responsible for the overall strategy, coordination and development of policies to strengthen the country’s cybersecurity.
“In this context, the national CSIRT operated by the Digital Security Authority, which functions around the clock, is a key operational mechanism for the early detection of and response to cyber incidents.
“Similarly, every business must incorporate the security of connected equipment into its operational planning as a management responsibility, just as it does with the safety of its premises and products.
“Cyber resilience requires continuous adaptation. No country and no business can assume it has absolute protection.
“Our responsibility is to keep strengthening our preparedness through planning, investment and cooperation, so that we can limit the impact of any incident on citizens and the economy.”