The EU is caught off guard by the Internet of Things

The cyberattack on 2 November targeting refrigerators in supermarkets across at least seven European countries has not yet been attributed to any specific group. Investigations are underway in Belgium, Luxembourg, Estonia, Finland, Sweden, Ireland and Italy, where, during the night between Monday and Tuesday, refrigerators began to overheat in hundreds of shops, forcing shopkeepers to throw away millions of euros’ worth of food. A similar attack had struck France on 11 October, for which no one has yet been held responsible.

Russia is stepping up its hybrid warfare attacks against Europe. Suspicious incidents are on the rise. Yesterday, at least seven aircraft were the subject of bomb threats, forcing an airport in Poland to close temporarily. But other malicious actors may also have an interest in resorting to cyberattacks. Following the fridge incidents, the Commission has also refrained from speculating on the identity of the hackers or who is behind them. However, “these incidents demonstrate once again how cyberattacks can compromise essential services and affect citizens’ daily lives”, said a Commission spokesperson. If there is one lesson to be learnt, it is just how vulnerable and ill-prepared EU Member States, businesses and citizens are to the current technological landscape. Between interconnections and the Internet of Things (IoT), malicious actors have countless points of entry at their disposal to exploit carelessness and negligence. If the malicious actor is a country seeking to dominate certain critical technologies – such as China’s dominance over IoT mobile modules – the risks go far beyond a few tonnes of frozen food having to be thrown away. The danger lies in leaving hostile regimes with a ‘switch’ to ‘shut down’ the normal lives of Europeans: from electric buses to wind turbines, from medical equipment to connected washing machines. The tools the Commission claims to have at its disposal – such as the Cyber Resilience Act and the Cyber Solidarity Act – are proving insufficient.