Cyber attacks on the refrigeration systems of European supermarkets, which also involved Italy, have brought attention back to the security of devices connected to the Internet. On 4 November 2026, ENISA, the European Union Agency for Cybersecurity, published a joint communication with other European institutions to invite organizations to take action on potentially exposed systems. The objective is not only to react to attacks that have already occurred, but above all to reduce system vulnerabilities and improve prevention capacity, through common rules, safer products and greater cooperation between countries.
The case of supermarkets also brings to the fore the role of the NIS2 directive, which requires certain companies, including those in some sectors of the food supply chain, to adopt cybersecurity measures to prevent attacks and limit their consequences. As Corrado Giustozzi, professor of cybersecurity at the Campus Bio-Medico University of Rome, explained to us, the European Union has been working for over ten years to improve the protection of digital systems, through an approach that involves both those who use the technologies and those who produce them. A concrete example of European collaboration comes from the recent incidents of commercial refrigeration systems: the response involved several European structures, including ENISA, Europol, the European Commission and the cyber incident response networks of the Member States, engaged in monitoring the situation and exchanging information.
Europe’s two strategies to prevent cyber attacks
The European approach to cybersecurity operates mainly on two levels:
- the first concerns organizations that use IT systems, from companies to operators of essential services. The aim is to increase awareness of the risks and introduce adequate prevention and protection measures. The NIS2 directive fits in this direction, which requires organizations falling within its scope of application to adopt measures to manage IT risks and report significant incidents to the competent authorities.
- the second level concerns device and software manufacturers. With the Cyber Resilience Act, which came into force in December 2024, the European Union introduced security requirements for products with digital elements, requiring that they be designed taking cyber risks into account and that manufacturers manage vulnerabilities even after marketing.
What the Cyber Resilience Act 2024 regulation provides for connected devices
Among the main European initiatives to prevent cyber attacks, as mentioned, there is the Cyber Resilience Act (CRA), EU Regulation 2024/2847, which came into force on 10 December 2024. The objective is to improve the security of products containing digital components, such as computers, devices connected to the Internet, industrial equipment and software, by imposing common cybersecurity requirements at European level on manufacturers. In Italy, the Council of Ministers approved on 2 October 2026 a draft legislative decree that adapts the national legislation to the CRA.
The principle underlying the regulation is that IT security must be guaranteed right from the design of the product and maintained even after its sale. Manufacturers will therefore have to evaluate IT risks, design devices with adequate protection measures, avoid marketing products with known and exploitable vulnerabilities without available remedies and intervene on security flaws that are discovered subsequently, even through free updates. They will also have to guarantee a support period generally of no less than 5 years, unless the expected duration of use of the product is shorter.
The main provisions of the Cyber Resilience Act will become applicable from 11 December 2027. However, as of 11 September 2026, the reporting obligations of actively exploited vulnerabilities and serious cyber incidents that compromise the security of the products concerned, to which Italian companies are already subject, came into force. An initial report is expected within 24 hours of becoming aware of it and a more detailed notification within 72 hours, through a European platform managed by ENISA. In the event of violations, consumers can report vulnerabilities and incidents to CSIRT Italia (national IT security intervention group).
The legislation establishes that the responsibility for IT security does not only fall on companies and citizens who use the devices, but also on those who design, produce and market them, a principle particularly relevant for connected industrial systems. Of course, the regulation does not guarantee that products placed on the market are completely free of vulnerabilities, but it imposes requirements to reduce and correct them. Furthermore, not all industrial systems automatically fall under the CRA: applicability depends on the characteristics of the product and any exclusions provided for by the regulation.
The regulation also applies to non-European producers and was created “precisely to be able to give European citizens the certainty that even non-European products guarantee them the same levels of safety that Europe expects and finds indispensable”, explains Giustozzi. The other, easier route would have been to prohibit the sale on European markets of products from manufacturers belonging to “untrusted” countries, as for example the United States has done by declaring the products of some Chinese manufacturers “unwanted”: «but this is an embargo, that is, a political act and Europe has instead chosen to leave the dialogue on a technical level, adopting rigorous but transparent regulations which have the aim of allowing everyone to sell their products in the Union, provided that respect the established safety measures”.
Could cyber attacks on supermarkets have been prevented?
Could the early application of the Cyber Resilience Act have helped prevent the cyber attacks on supermarkets in recent days? «In reality, prevention is entrusted to two regulations that cooperate: one has already been in force since 2024, the NIS2 Directive, and the other will complete its entry into force next year, i.e. the CRA. For a couple of years now, the NIS2 Directive has required companies and organizations (including those in the large-scale food distribution chain) to raise and constantly verify the technical and organizational security measures to protect their business, also considering the risks of an incorrect security posture of their suppliers and service providers such as remote maintenance companies”.
As Giustozzi further explains, the affected companies «have failed in many things already mandatory under NIS2 such as: having left access to critical components such as refrigerators exposed on the Internet; not having applied the manufacturers’ security updates, already available for some time, which would have remedied the vulnerabilities exploited by the attackers; not having used more secure mechanisms to allow remote maintenance of refrigerators by authorized parties only, such as the use of VPN and double-factor authentication; as well as deficiencies in monitoring and errors in the timely detection of anomalous situations”.
The legislation does not necessarily concern all large-scale retail outlets, but for Giustozzi the companies involved probably made errors in the management and configuration of the systems that they should not have made under the NIS2 already in force. The CRA, however, applies to device manufacturers, imposing on them, among other things, secure design criteria by design And by defaultas well as the timely correction of any vulnerabilities as soon as they are discovered. “If it had already been in force, many supermarkets would probably not have found themselves, without their knowledge, having products vulnerable to attacks like the one that occurred at home.” The CRA, therefore, will be able to reduce the risk of marketing new insecure products, without however automatically eliminating the vulnerabilities of existing equipment.
What Europe is still missing and what are the risks until 2027
«Europe is unfortunately a complicated place, with 27 countries to reach an agreement: and when the issues are particularly critical, as in the case of national security or industrial and production ecosystems, differences in vision and jealousies on aspects of national sovereignty become an obstacle in quickly finding shared solutions that gain everyone’s consensus», explains Corrado Giustozzi.
It is no coincidence, for example, that the GDPR which protects the processing of citizens’ data was issued as regulationi.e. a rule of the highest rank that applies as is in all Member States without the possibility of modification. NIS and NIS2, which concern safety aspects of operators and supply chains that ensure the maintenance of essential services, were instead issued as directivei.e. a lower-ranking rule which involves the step of “transposition” into national legislation by each Member State with extensive “customization” possibilities. The result is still a rather uneven Europe in terms of implementation of what should be a great common defense plan.
Nonetheless, continues Giustozzi, «Europe has nevertheless made an extraordinary journey to secure all the ecosystems of production, services, markets, healthcare and products, both industrial and consumer, designing a complex but coherent puzzle in which each plays its own role, with the aim of raising in a coordinated way the security of the common cyber space and of all the digital services and products essential to the normal functioning of civil society». Cybersecurity is not so much a technical problem as an organizational and cultural problem, and as such it must be addressed: a bit like what was done for safety in the workplace, the protection of the environment and that of personal data.
It is natural to ask whether December 11, 2027, the date by which the main requirements of the CRA must be applied, is not too far away to respond to the cyber threats of this period. «Considering that the first “cyberstrategy” of the European Union, in which Parliament and Council took note of the new incoming threat and the need for Member States to prepare common defenses, dates back to 2013, I would say that we have come a long way. And, probably, it would not have been possible to go faster than this, because there are so many things to do and they have a huge impact on the functioning of society.”
Since 2013, government structures for prevention and enforcement have been created (first the CERTs, then the “cyber arm” of Europol called EC3, then the NIS national contact points and the related transnational rapid communication network, finally the cyber competence center in Bucharest); pan-European exercises have been launched where Member States simulate attacks on critical sectors and verify their collective response capacity; regulations have been passed to increase organizational and technical safety in companies (NIS and NIS2, DORA); regulations have been passed to increase technical safety in digital products and services (CRA, DSA, Machinery Directive).
«Is 2027 far away? Not so much now: and in fact the device manufacturers are even complaining that it is too close, and they fear they won’t have time to adapt!», concludes Giustozzi.
