Loading story…
European officials and industry reporting have highlighted a widening threat to critical infrastructure as cyber risks to electricity networks grow alongside military monitoring of subsea assets. An International Energy Agency assessment cited in Spanish reporting said cyberattacks on critical energy infrastructure rose 30% in 2023 to 420 million globally, while attacks on energy service companies have quadrupled since 2020. Recent incidents include the 2022 satellite communications disruption that knocked 5,800 wind turbines offline in Germany and breaches affecting more than 20 Danish energy companies. Authorities have also warned that compromised smart meters, solar inverters, and battery systems could be used to destabilize grid frequency or trigger broader outages.
The concern extends beyond direct hacking to supply-chain and geopolitical exposure tied to digitally connected clean-energy equipment and other strategic infrastructure. European and U.S. authorities reviewed communications modules in imported solar and battery systems, while Lithuania moved to block remote access by Chinese suppliers to solar, wind, and storage control platforms. Separately, the UK said British and Norwegian forces carried out a month-long operation to track a Russian attack submarine and two GUGI-linked spy submarines near North Atlantic cables and pipelines, underscoring fears that hostile states could target the seabed networks that carry 99% of international telecommunications traffic and support a major share of regional energy supplies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-09, the UK revealed the joint operation with Norway and said the Russian vessels withdrew. Defence Secretary John Healey said no damage to UK cables or pipelines was found and warned against interference with critical seabed infrastructure.
Before April 2026, British and Norwegian forces carried out a month-long secret operation in the North Atlantic to monitor and deter three suspected Russian spy submarines near undersea cables and pipelines north of the UK.
In 2025, U.S. and EU authorities examined communication modules in imported solar and battery equipment over concerns they could enable remote manipulation or strategic disruption.
In 2024, Lithuania barred Chinese suppliers from remotely accessing control systems for solar, wind, and energy storage installations, citing national security concerns.
The International Energy Agency reported that cyberattacks on critical energy infrastructure reached 420 million worldwide in 2023, up 30% from the previous year.
About a year after the February 2022 turbine disruption, more than 20 Danish energy companies were hit by security breaches, marking a significant multi-victim incident in the Nordic energy sector.
By 2023, attacks on energy service companies had quadrupled compared with 2020 levels, reflecting a sustained escalation in targeting of the energy sector.
In February 2022, a satellite communications disruption affected 5,800 wind turbines in Germany, illustrating how attacks on supporting communications infrastructure can disrupt renewable energy operations.
2 references tracked. Mallory keeps watching after this page renders.
elmundo.es
Open sourceelmundo.es
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A massive power outage affected Spain, Portugal, and parts of southwestern France, leaving tens of millions without electricity for hours due to cascading failures in the power generation and transmission systems. The incident, which was not caused by a cyberattack but by technical and operational failures, highlighted the fragility of interconnected European grids and raised concerns about the preparedness of critical infrastructure against both accidental and malicious disruptions. Experts noted that fragmented incident handling and lack of coordination among European operators exacerbate the risk of widespread outages, drawing parallels to past cyberattacks on power grids such as the 2015 Ukraine incident. In response to increasing threats, industry analysts and regulators are urging grid operators to unify cybersecurity and physical security strategies. The convergence of operational technology (OT) and information technology (IT) has exposed critical infrastructure to a broader range of cyberthreats, including ransomware and malware, while physical attacks on grid assets have also surged in recent years. Surveys indicate that grid operators are equally concerned about cyber and physical risks, emphasizing the need for integrated security approaches to safeguard the reliability and resilience of power delivery systems.
Jun 29, 2026
Critical infrastructure worldwide, including power grids, water systems, and transportation networks, is increasingly vulnerable due to aging hardware and outdated cybersecurity measures. Many of these systems, built between the 1950s and 1970s, were never designed for the hyperconnected digital environment of today, leaving them exposed to both physical decay and cyber threats. In the United States, nearly 70% of the power grid is over 25 years old, and similar conditions exist in Europe, with a significant portion of bridges and other infrastructure in need of repair. As operators modernize these systems with digital controls and cloud-based monitoring, new attack surfaces emerge, such as legacy interfaces, unpatched software, and unsupported protocols, which can be exploited by threat actors. The interconnectedness of these systems means that a single vulnerability, such as an infected maintenance laptop or a misconfigured firewall, can have cascading effects across multiple sectors. The adoption of digital twins and shared data platforms is helping operators predict failures and coordinate responses, but the risk remains high. The rapid growth of renewable energy, particularly solar power, has introduced additional cybersecurity challenges. Solar inverters, aggregators, and control software have become attractive targets for cybercriminals, as demonstrated by real-world incidents where hackers exploited default credentials and known software flaws to hijack remote monitoring devices. The FBI has issued alerts about threats to renewable energy systems, and experts warn that tampering with connected infrastructures, including EV charging networks, could lead to widespread blackouts. The transition to renewables is outpacing the implementation of robust cybersecurity measures, making the sector a potential weak link in national energy resilience. High-profile attacks, such as the hijacking of 800 monitoring devices in Japan using a Mirai botnet-linked vulnerability, highlight the global nature of the threat. Hacktivist groups have also targeted solar monitoring systems, further exposing the sector's vulnerabilities. The integration of renewables into the grid, often outside the direct control of traditional operators, complicates efforts to secure the entire energy ecosystem. As the share of renewables in power generation is projected to rise significantly by 2030, the urgency to address these cybersecurity gaps is growing. Experts emphasize the need for proactive monitoring, regular updates, and coordinated information sharing between engineers and security teams to mitigate risks. The resilience of critical infrastructure now depends not only on physical maintenance but also on the ability to anticipate and defend against sophisticated cyber threats targeting both legacy and emerging technologies.
Jun 29, 2026
Senior officials from the **EU, NATO, the United States, Sweden, Estonia, and Taiwan** used the Munich Cyber Security Conference to warn that cyber and “hybrid” operations are now a persistent feature of geopolitical competition and are increasingly aimed at **critical infrastructure** (energy, health, government services, satellites, and military command networks). EU Executive Vice President **Henna Virkkunen** argued Europe cannot be “naive” about adversaries’ ability to disrupt essential services and pointed to proposed revisions to the **EU Cybersecurity Act** intended to strengthen the EU cybersecurity agency and reduce critical ICT supply-chain risk, including phasing out designated **high-risk suppliers**. NATO Deputy Secretary General **Radmila Shekerinska** said Russia and China are challenging the alliance in both physical and digital domains and cited attempted disruptions to Poland’s energy infrastructure as an example of the threat environment. U.S. officials signaled a shift from primarily defensive “resilience” toward **deterrence** by “imposing real costs” on malicious actors, while also emphasizing deeper cyber partnerships with allies and industry to send a coordinated message to adversaries; National Cyber Director **Sean Cairncross** said a forthcoming U.S. cyber strategy will align with broader national security strategy and rely on whole-of-government tools. Estonia’s intelligence chief **Kaupo Rosin** urged Europe to invest in **homegrown offensive cyber capabilities** to reduce reliance on non-European tools, while Swedish defense official **Lisa Gustafsson** said societies must be designed to function under sustained disruption under Sweden’s “total defense” model. Taiwan’s National Security Council adviser **Yuh-Jye Lee** warned China may be rehearsing a “digital siege,” referencing activity like **Volt Typhoon** and reporting on alleged Chinese training infrastructure (“**Expedition Cloud**”) designed to simulate foreign power grids and communications networks; separate reporting also underscored that much of the technology stack underpinning cyber defense is controlled by **U.S. firms**, complicating sovereignty and supply-chain decisions.
Jun 29, 2026