Loading story…
A Centrii risk assessment found that a coordinated compromise of cloud-based battery-storage control platforms could destabilize the ERCOT grid by maliciously coordinating battery dispatch. The model estimates that control of roughly 1,500 one-megawatt units—about 5.4% of Texas’s battery fleet—could disrupt frequency response, potentially interrupting service for up to 30 million people and causing as much as $65 billion in economic damage. Centralized optimizer and manufacturer cloud services, rather than individual batteries, are identified as the critical control-plane targets.
Malicious battery commands could resemble legitimate frequency-response activity or a poorly tuned controller, complicating detection and attribution during an incident. Centrii estimated a 92% probability of a notable battery-infrastructure cyberattack by 2031 under industry-average security practices; upgrading the fleet to IEC 62443 Security Level 2 could reduce the modeled attack’s effectiveness at an estimated $800 million to $2.8 billion. The findings are simulation-based risk estimates, not evidence that a battery-grid cyberattack has occurred.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
A 49-member expert panel concluded that Spain's blackout resulted from oscillations, voltage-control, and protection issues rather than a cyberattack. ENTSO-E published its final report and noted that key data from initially tripped power plants was unavailable.
Spain's power grid collapsed after a converter-driven forced oscillation at 0.63 Hz. The incident was initially difficult to diagnose.
Research by Afzal and colleagues found that altering load equivalent to 15% of a battery fleet's power could push grid frequency outside normal operating bounds.
Centrii published a risk assessment modeling coordinated compromise of grid-connected battery assets, estimating that compromise of about 1,500 ERCOT battery units, or 5.4% of the fleet, could destabilize the Texas grid. The modeled scenario could affect up to 30 million people and cause up to $65 billion in damage; it was not evidence of an actual battery-grid cyberattack.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European officials and industry reporting have highlighted a widening threat to critical infrastructure as cyber risks to electricity networks grow alongside military monitoring of subsea assets. An International Energy Agency assessment cited in Spanish reporting said cyberattacks on critical energy infrastructure rose 30% in 2023 to **420 million** globally, while attacks on energy service companies have quadrupled since 2020. Recent incidents include the 2022 satellite communications disruption that knocked **5,800 wind turbines** offline in Germany and breaches affecting more than 20 Danish energy companies. Authorities have also warned that compromised smart meters, solar inverters, and battery systems could be used to destabilize grid frequency or trigger broader outages. The concern extends beyond direct hacking to supply-chain and geopolitical exposure tied to digitally connected clean-energy equipment and other strategic infrastructure. European and U.S. authorities reviewed communications modules in imported solar and battery systems, while Lithuania moved to block remote access by Chinese suppliers to solar, wind, and storage control platforms. Separately, the UK said British and Norwegian forces carried out a month-long operation to track a Russian attack submarine and two GUGI-linked spy submarines near North Atlantic cables and pipelines, underscoring fears that hostile states could target the seabed networks that carry **99% of international telecommunications traffic** and support a major share of regional energy supplies.
Jun 29, 2026
Critical infrastructure worldwide, including power grids, water systems, and transportation networks, is increasingly vulnerable due to aging hardware and outdated cybersecurity measures. Many of these systems, built between the 1950s and 1970s, were never designed for the hyperconnected digital environment of today, leaving them exposed to both physical decay and cyber threats. In the United States, nearly 70% of the power grid is over 25 years old, and similar conditions exist in Europe, with a significant portion of bridges and other infrastructure in need of repair. As operators modernize these systems with digital controls and cloud-based monitoring, new attack surfaces emerge, such as legacy interfaces, unpatched software, and unsupported protocols, which can be exploited by threat actors. The interconnectedness of these systems means that a single vulnerability, such as an infected maintenance laptop or a misconfigured firewall, can have cascading effects across multiple sectors. The adoption of digital twins and shared data platforms is helping operators predict failures and coordinate responses, but the risk remains high. The rapid growth of renewable energy, particularly solar power, has introduced additional cybersecurity challenges. Solar inverters, aggregators, and control software have become attractive targets for cybercriminals, as demonstrated by real-world incidents where hackers exploited default credentials and known software flaws to hijack remote monitoring devices. The FBI has issued alerts about threats to renewable energy systems, and experts warn that tampering with connected infrastructures, including EV charging networks, could lead to widespread blackouts. The transition to renewables is outpacing the implementation of robust cybersecurity measures, making the sector a potential weak link in national energy resilience. High-profile attacks, such as the hijacking of 800 monitoring devices in Japan using a Mirai botnet-linked vulnerability, highlight the global nature of the threat. Hacktivist groups have also targeted solar monitoring systems, further exposing the sector's vulnerabilities. The integration of renewables into the grid, often outside the direct control of traditional operators, complicates efforts to secure the entire energy ecosystem. As the share of renewables in power generation is projected to rise significantly by 2030, the urgency to address these cybersecurity gaps is growing. Experts emphasize the need for proactive monitoring, regular updates, and coordinated information sharing between engineers and security teams to mitigate risks. The resilience of critical infrastructure now depends not only on physical maintenance but also on the ability to anticipate and defend against sophisticated cyber threats targeting both legacy and emerging technologies.
Jun 29, 2026
Reporting described how **digital sabotage of industrial control systems (ICS)** can translate directly into physical disruption of critical infrastructure, using a Caracas blackout scenario to illustrate how attackers could manipulate modern, internet-connected controllers. The piece highlights techniques where malware can create a “split reality” by intercepting legitimate operator commands and substituting malicious instructions to destabilize grid operations, underscoring how grid modernization expands the attack surface and enables cyber effects to be synchronized with real-world operations. Separate commentary on San Francisco’s “**Waymo Freeze**” argued that even without a cyber compromise, tightly coupled cyber-physical systems can fail at scale when environmental dependencies break (e.g., traffic signals and city systems impacted by a power outage). It framed the incident as an **identity and resilience** problem—asserting that static device identity models (e.g., *PKI*-based trust) do not ensure operational continuity when conditions change—highlighting the broader executive risk that safety defaults and fail-safe behaviors can still produce city-level disruption during outages or cascading infrastructure failures.
Jun 29, 2026