How vulnerable is our daily lives to the ever-increasing threat of cyberattacks? The recent incidents in Europe, where hackers managed to remotely interfere with supermarket refrigeration systems, are just an indication of the impact that a malicious digital energy can have on things that as citizens have taken for granted for many decades.
Cyberattacks are no longer limited to the interception of personal data, electronic fraud or the breach of information systems, but can directly affect basic infrastructure and services that have evolved over time into basic needs for modern humans.
"F tis Kyriakis" today hosts statements by the Director of the Deputy Ministry of Research, Innovation and Digital Policy, Marios Tziapura, and the Commissioner for Communications, Marios Pieris. The former is responsible at the technocratic level for cybersecurity issues in the Republic of Cyprus, while the latter is responsible for supervision and control, through the Digital Security Authority.
The attacks started in France
The attacks on supermarket refrigeration systems began on October 12, when there was a coordinated cyberattack on about 700 supermarket stores in France. Simply put, the attackers gained access to cooling control systems and remotely activated the defrost function overnight.
The incident resulted in overheating of refrigerators and freezers, significant food losses and, in some cases, the outbreak of fires. Following the attack, supermarket workers were forced to remove large amounts of spoiled food, including meat and ice cream that had melted, taking them to huge trash cans.
The company behind many of the affected refrigeration units said several were old-tech or operated with outdated software, potentially making it easier for hackers to access the systems. The financial cost of the attack is estimated to be in the tens of millions of euros nationwide, according to a French supermarket owner.
The wave in Europe
On November 2, 2026, a new wave of similar incidents was recorded in at least nine European countries. These are Belgium, Sweden, the Netherlands, Estonia, Ireland, Finland, Luxembourg, Portugal and Italy.
Refrigerators used by French blood banks were even targeted, forcing workers to transfer part of the blood stocks to other cold storage units. In Sweden, a store manager in Stockholm told Reuters that freezers reached 50 degrees Celsius, resulting in the destruction of products.
APSA warning in Cyprus
The Digital Security Authority on November 7 issued a statement warning all companies in Cyprus to take precautionary measures on the occasion of the ongoing cyberattack campaign targeting Operational Technology and Industrial Control (OT/ICS) systems in European Union member states.
In relation to the attacks in Europe, the DSA pointed out that legitimate functions of the control systems, which were accessible from the internet and in several cases protected by predefined or weak access credentials, appeared to have been exploited.
Given that similar automation, telemetry and control infrastructures (SCADA, BMS, PLC) are also used in our country, the Digital Security Authority called on "all key and important entities" to immediately proceed with an audit of their systems and the implementation of the necessary shielding measures.
In particular, the main precautionary measures that APSA called on businesses to take are:
– Restriction of remote access (only via VPN and with MFA)
– Change default or weak codes
– Updating software and firmware of the systems
– Separation of IT and OT networks
– Continuous monitoring of operation and temperatures, having a response plan
APSA assured that it is closely monitoring developments and is in communication with the relevant national and European authorities to assess the threat, exchange information and strengthen the protection of the country's infrastructure and businesses.
The Commissioner for Communications underlined that the protection of critical digital and industrial infrastructure is a collective responsibility and a key pillar of the country's cyber resilience.
It was clarified, however, that the warning is of a precautionary nature and does not constitute confirmation of a similar incident in the Republic of Cyprus.
The French see Iran
On November 9, French authorities attributed the October attack to the Shahid Kaveh cyber operations unit, which they associate with Iran's Revolutionary Guards.
French intelligence and cybersecurity services claim to have identified common elements between the digital infrastructure used in the attacks and previous operations by this group. Among the findings are the use of specific tools for locating industrial systems, references to online networks linked to the group, and traces of the Persian language.
Of particular concern is the fact that, according to the same report, the cyberattack was not limited to the refrigeration systems of supermarkets and food businesses, but also included the targeting of equipment of small hydropower plants in France.
The French government described the attack as unprecedented in its scale and aggressiveness, while announcing that it would seek the imposition of new European sanctions against Iranian individuals and organizations. The official attribution of responsibility concerns the October attacks in France, as it has not been confirmed that the same group was behind the subsequent incidents in other European countries.
New Commission guidelines for the first 72 hours of crisis
Earlier this month, the European Commission put forward new guidelines to strengthen the population's preparedness in emergencies and times of crisis. Among the incidents that are being talked about are cyberattacks, which in their current form can affect even the basic survival needs of a person in the 21st century.
The new directives are a follow-up to the EU Preparedness Union Strategy, adopted in March 2025, with the aim of strengthening Europe's resilience against natural disasters, geopolitical crises, hybrid threats and cyberattacks.
Particular emphasis is placed on the creation of an emergency backpack, which will include basic supplies to meet the needs of citizens during the first three days of a crisis. This recommendation is particularly important in light of modern cyber threats, as a potential large-scale attack could cause disruptions to electricity, water, telecommunications or other essential services.
What the 72 Hour Kit Should Include
The Commission does not impose a single, mandatory list of items. However, he proposes a practical list which includes:
-Drinking water and long-life foods that do not need refrigeration or cooking
-Medicines for daily use and first aid kit
-Flashlight, spare batteries and portable radio with batteries
-Mobile phone, charger and charged power bank
-Small amount of cash in case of inability to make electronic payments
-Copies of ID, passport, and important documents in a waterproof case
-Personal hygiene items such as antiseptic, tissues and wet wipes
-Change of clothes, warm garment and survival blanket
-Whistle, multi-tool and spare keys
-Special items for infants, the elderly, people with disabilities or pets, depending on the needs of each
Marios Pieris: When the cyber attack reaches the supermarket shelf
-Medicines for daily use and first aid kit
-Flashlight, spare batteries and portable radio with batteries
-Mobile phone, charger and charged power bank
-Small amount of cash in case of inability to make electronic payments
-Copies of ID, passport, and important documents in a waterproof case
-Personal hygiene items such as antiseptic, tissues and wet wipes
-Change of clothes, warm garment and survival blanket
-Whistle, multi-tool and spare keys
-Special items for infants, the elderly, people with disabilities or pets, depending on the needs of each
Marios Pieris: When the cyber attack reaches the supermarket shelf
Commissioner for Communications"In recent weeks, Europe has experienced an unprecedented phenomenon. In October, unknown persons gained access to the refrigeration control systems of hundreds of French supermarkets and, in the middle of the night, turned up the temperature in refrigerators and freezers. The result was tons of damaged food and, in some stores, fires. On November 2, a second wave followed, hitting supermarkets in over ten more European countries. The positive thing is that so far no relevant incident has been reported in Cyprus. The Digital Security Authority is closely monitoring the evolution of the situation, in constant contact with its European partners, and is ready to respond immediately, if necessary.
We are today more ready than ever. With the implementation of the European NIS2 Directive on cybersecurity measures in Cyprus, the critical entities under supervision increased from about 70 to about 500. Through our European cooperation networks, we also receive timely information about threats found elsewhere, often before they reach us. But preparedness is not only a matter for the state.
These incidents teach us two things. First, cybersecurity is no longer just about data, but also about the physical world: the food we buy, public health, facility security. Second, the attacks did not require advanced techniques. The attackers exploited systems exposed to the public internet, many with predefined or weak codes. We will see such phenomena more and more often, and I emphasize that there was no need for very specialized attacks. It's just that the systems were vulnerable. Although the systems could be shielded relatively easily, this was obviously not done.
Connecting devices to the internet is not a problem in itself. The problem is the connection without control and without the necessary security measures. I therefore call on those who operate such systems, and not only supermarkets, to take the following measures immediately:
>not leave control systems exposed to the public internet, and allow remote access only through a secure connection, in a controlled manner;
>change all predefined codes, implement multi-factor authentication and install security updates, where available;
>separate information technology (IT) networks from device networks (Operational Technology / Internet of Things),
>to ask suppliers and their maintainers to confirm the security measures they are implementing,
>receive notifications of unauthorized changes, and have the ability to manually review and respond to incidents.
Finally, let me mention that safety is a common responsibility of all of us. The Authority guides and supervises, but the first line of defense is each organization. Anyone who detects suspicious activity can report it immediately to CSIRT-CY at 1490, to receive relevant guidance. Timely information can prevent damage."
Marios Tziapuras: Cybersecurity is a national security issue
We are today more ready than ever. With the implementation of the European NIS2 Directive on cybersecurity measures in Cyprus, the critical entities under supervision increased from about 70 to about 500. Through our European cooperation networks, we also receive timely information about threats found elsewhere, often before they reach us. But preparedness is not only a matter for the state.
These incidents teach us two things. First, cybersecurity is no longer just about data, but also about the physical world: the food we buy, public health, facility security. Second, the attacks did not require advanced techniques. The attackers exploited systems exposed to the public internet, many with predefined or weak codes. We will see such phenomena more and more often, and I emphasize that there was no need for very specialized attacks. It's just that the systems were vulnerable. Although the systems could be shielded relatively easily, this was obviously not done.
Connecting devices to the internet is not a problem in itself. The problem is the connection without control and without the necessary security measures. I therefore call on those who operate such systems, and not only supermarkets, to take the following measures immediately:
>not leave control systems exposed to the public internet, and allow remote access only through a secure connection, in a controlled manner;
>change all predefined codes, implement multi-factor authentication and install security updates, where available;
>separate information technology (IT) networks from device networks (Operational Technology / Internet of Things),
>to ask suppliers and their maintainers to confirm the security measures they are implementing,
>receive notifications of unauthorized changes, and have the ability to manually review and respond to incidents.
Finally, let me mention that safety is a common responsibility of all of us. The Authority guides and supervises, but the first line of defense is each organization. Anyone who detects suspicious activity can report it immediately to CSIRT-CY at 1490, to receive relevant guidance. Timely information can prevent damage."
Marios Tziapuras: Cybersecurity is a national security issue
Director of Cybersecurity, Deputy Ministry of Research, Innovation and Digital Policy"The recent cyberattacks on supermarket refrigeration systems in European countries highlight how directly a digital threat can affect the operation of the market, the daily lives of citizens and the economy in general.
The more devices and infrastructures are interconnected, the greater the points of exposure to malicious actions. At the same time, attacks are becoming more frequent and sophisticated, while artificial intelligence is expanding access to advanced tools, enhancing the capabilities of attackers. In the face of this reality, the European Union is shaping a comprehensive cybersecurity framework, through initiatives such as the Cybersecurity Act, the NIS2 Directive, the Cyber Resilience Act and the Cyber Solidarity Act, strengthening the protection of critical infrastructure, businesses and digital products and services. Cyprus has already aligned its national framework with the NIS2 Directive, strengthening cybersecurity requirements in more sectors of the economy, including the food supply chain.
For the Government, cybersecurity is a matter of national security, economic resilience and citizen protection. Digital progress requires trust and reliable services. That's why we invest in a comprehensive approach, from prevention and early detection to effective management and rapid recovery. The central goal is the continuity of essential services, even when an attack occurs.
This commitment is also clearly reflected in the state budget of the current government where, for the first time, and for the third consecutive year, separate funding of around €10 million is foreseen. annually for cybersecurity.
We place particular emphasis on the protection of critical infrastructure and services, on preparedness exercises and on the cooperation of the competent authorities with the operating bodies and our European partners. The Government is responsible for the overall strategy, coordination and formulation of policies to strengthen the country's cybersecurity. In this context, the Digital Security Authority's National CSIRT, which operates around the clock, is a key operational mechanism for the early detection and response to cyber incidents.
Accordingly, every company must include the safety of connected equipment in its business planning, as a responsibility of the management, such as the safety of its facilities and products.
Cyber resilience requires continuous adaptation. No state and no company can consider that it has absolute protection. It is our responsibility to constantly strengthen our preparation, with a plan, investments and cooperation, in order to limit the impact of each incident on citizens and the economy."
