Recent Attacks Turn Up the Heat on Europe's Cybersecurity

On Tuesday 13 October 2026, I attended a Cybersecurity Breakfast event, hosted by Luxembourg’s AI Factory, which, amongst a myriad of related subjects, featured talks on vulnerabilities and ransomware. That very same day, the news broke that hackers had raised the temperature of refrigerators and freezers at hundreds of French supermarkets causing fires and spoiling food. Only three weeks later, Luxembourg’s Delhaize supermarkets fell victim to a similar attack.

Now, it appears Luxembourg was not specifically targeted, with Delhaize and other supermarkets across Sweden, Belgium and Ireland also affected in this particular attack. The choice of whom and where to attack was likely to be rooted in the origins of the ICT system vulnerabilities which allowed the exploits to happen but the decision to exploit those vulnerabilities implies that nefarious actors are probing systems which, up until now, will have been loosely classified as “non-critical”. In the new age of AI-exposed software vulnerabilities, that lower level of classification no longer seems suitable.

An interlinked issue

Supply chains are called “chains” for a reason; they are interlinked and, as the old phrase goes, “a chain is only as strong as the weakest link”. We now exist in a world where every failure in digital security is an exploit waiting to happen. Given that we have transferred a large amount of our lives to the digital domain, this means that we are all, in effect, in the target line.

The level of vulnerabilities which currently exist is unfortunately not limited to the popularity or ubiquity of any particular technology. For example, not everyone owns a robot vacuum cleaner but if you own a DJI Romo vacuum cleaner you will most likely know that you inadvertently invited a significant digital vulnerability into your very own living space.

In January of this year, while developing an application to control his own robot vacuum cleaner using a PlayStation 5 controller, software engineer Sammy Azdoufal discovered he could access data from thousands of other DJI Romo units around the world. This unexpected exploit gave him access to each unit’s live camera feed, microphone audio, detailed floor plans of private residences, device status information and the approximate locations of almost 7,000 DJI Romo units in 24 countries.

Using AI-based Claude Code software, he reverse engineered the code running on the device and uncovered a major vulnerability no one was [publicly] aware of. But was this a “vulnerability” or simply an existing backdoor which could be utilised in a nefarious fashion? The answer is likely both.

Leaving the back door open

Around ten years ago stories began to surface of strange coincidences where targeted advertising seemed to align with casual conversations people had been recently having, with products being recommended to them on various platforms that did not relate to any previous search history but did seem to align with a subject matter which had been discussed “off device”. This apparent quirk of circumstance became so common place that it fuelled a number of conspiracy theories about smartphones covertly listening in on people’s conversations. The problem was it turned out this was true.

Ordinarily, or as the public were led to believe, any audio recording taking place on a smartphone or other smart device, such as an internet-connected home speaker, would only be triggered with a specific voice command from the device’s user (e.g. “Hey, Siri”) but it turns out that certain applications on these devices have triggers built in to record whatever is being picked up on the devices’ microphone at any given time and then that information is communicated back to the application developer’s servers. Not just under the guise of improving services but, in many cases, to sell that data to advertisers for profit, who in turn can distribute targeted adverts related to the subjects one had been discussing privately.

Frighteningly, smart televisions have been doing the same thing… even when they appear to be switched off.

This is the curse of the “internet of things”, the network of devices connected to the internet for what the manufacturers describe as “convenience”. This connectivity is meant to allow for automated software updates to appliances such as one’s fridge, kettle or home printer. But let’s be honest, these updates are more often than not used to fix software/firmware faults in products not fully tested but still released to market or to patch security holes in software you are forced to use with such internet-connected devices.

In the case of certain home printer manufacturers, this backdoor functionality has given them control over how and when one can use a device, locking down features such as firmware and security updates should you forget to pay your monthly subscription to their services or making hardware nonfunctioning if one has chosen to use cheaper third-party ink cartridges instead of those available from the printer manufacturer.

The software which allows this kind of back door access is often referred to as “bloatware” and it often comes with a multitude of security issues. Most of these issues have remained dormant. Worryingly, AI is now locating them and waking them up.

Attacks on Europe’s infrastructure

In the case of the fridges and freezers used by Delhaize, this back door technology will be used by the company across its vast European retail network to allow for hardware monitoring, distributing firmware and software updates and to gather data on aspects such as energy usage - a critical cost point for the company, particularly with energy costs being at elevated levels. 

The first cyberattacks on supermarket infrastructure in France were reported to have affected around 80 of Carrefour’s 490 stores in the country, suggesting that the exploit was likely only applicable to a certain make and/or model of refrigeration equipment. Given the size of the company this is not unexpected, as equipment is replaced at different times and contracts with equipment providers will not be universally the same across every location. This natural inconsistency in their infrastructure may have inadvertently given them an unexpected level of security and prevented their whole internet-connected cold storage network from being taken down in one go. It is certainly testament to not sticking all of your technological eggs in the same technology provider basket. But surely there is some form of security regulation for these networks of devices and how they can be accessed and controlled?

The answer is both yes and no. And yes does not guarantee security.

Are existing protections sufficient?

The Network and Information Security Directive 2 (NIS2) is the European Union's main cybersecurity directive, designed to establish a consistent level of cybersecurity across EU Member States. It replaces the earlier NIS Directive and expands the number of sectors and organisations subject to cybersecurity obligations. Its scope includes sectors such as energy, transport, healthcare, digital infrastructure, financial market infrastructure, public administration, manufacturing and digital services.

NIS2 requires organisations within its scope to implement appropriate technical, operational and organisational measures to manage cybersecurity risks. These include risk analysis, incident handling, business continuity and disaster recovery, supply-chain security, vulnerability management, access controls, encryption and security awareness training. 

It also comes with strict incident-reporting obligations: organisations must provide an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report generally within one month. Management bodies are also directly accountable for approving and overseeing cybersecurity risk-management measures and must undertake relevant training. 

NIS2 does not, however, automatically cover sectors such as retail and leaves quite a significant part of the European economy outside its direct sectoral scope. This includes, among others, construction and property infrastructure (including building and home automation; heating, ventilation and air conditioning; elevators and access-control systems), agriculture and farming (including livestock management systems; automated feeding systems; irrigation controls; and greenhouse automation), and other “non-critical” infrastructure such as electrical car charging points, private security surveillance equipment and, in some cases, educational technology systems.

This is not to suggest that security is either lax or non-existent in these areas but their lack of coverage under the current EU cybersecurity directive shows just how inconsistent the realm of security in our ever-expanding digital infrastructure is. An infrastructure which has a lot of links in a lot of chains.

Luxembourg’s financial centre falls under the Digital Operational Resilience Act (DORA) which, while similar in scope to NIS2, covers a broad range of financial entities, including banks, insurance companies, investment firms, payment institutions, electronic money institutions, crypto-asset service providers and certain financial market infrastructures across the EU. Significantly, it also brings ICT third-party service providers, such as cloud computing and technology providers, into a formal oversight framework where they are designated as “critical”. This represents a much greater set of protections across the technology chain but only for those financial industries.

Pointing fingers won’t fix the holes

One worrying lack of EU oversight in both of these domains relates to the usage of critical equipment which has been designed and manufactured in countries outside of the EU, an aspect which significantly spooked US authorities in the 2000s due to national security concerns about the use of equipment from China’s Huawai in critical US infrastructure.

But as the AI hyperscalers continue to develop AI models with ever greater capability, the origins of these cyberthreats become somewhat moot and the source of the equipment even more so. For example, hackers in North Korea can be blamed for the recent €6bn Binance crypto hack but the current AI-based tools which allow these tasks to be accomplished are already in the hands of non-state actors who are difficult to identify, track and hold accountable. The protagonists in the attacks on European supermarket infrastructure have yet to be identified and the issues have now quickly escalated to more critical areas, with France’s blood banks being targeted in a similar fashion.

The EU needs to have a very serious conversation about how the backdoors to our digital infrastructure – be they regarded as critical or not - are governed; otherwise what we expose in the name of apparent convenience will become the chains that bind us to a cybersecurity hell.