In February 2022, the same day the Russian invasion of Ukraine began, a massive satellite connection outage in Europe unexpectedly halted the monitoring and remote control of 5,800 wind turbines in Germany. A year later, more than twenty Danish energy companies experienced security breaches, leading to selective disconnections and the isolation of their networks to prevent contagion to the entire system.
Europe - and within it Spain - are leading the way in renewables and the electrification of economies as the main path to withstand the roller coaster of gas and oil prices driven by wars and trade tensions. However, the electrification era has opened up new vulnerabilities for national security, placing renewable plants and electrical grids at the center of the geopolitical sabotage target. This is warned by the International Energy Agency (IEA), the energy arm of the OECD, in the latest edition of its Energy Technology Perspectives report.
"Electric grids are the backbone of transitions to clean energies. As digital controls, sensors, and connected devices proliferate to integrate renewable energies and operate systems closer to their limits, cyber risk exposure grows in scale and complexity," the document highlights.
The Agency estimates that attacks on these critical infrastructures surged by 30% in 2023, reaching a total of 420 million worldwide. Additionally, attacks on energy service companies have quadrupled since 2020. A significant case is that of the United States, where it is estimated that vulnerable points in the electrical grid have increased by 60 per day, rising from 21,000 in 2022 to nearly 24,000 in 2024, the latest available data. The average cost of each security breach there is around $4.8 million.
The growing digitalization of electrical systems is necessary to manage the massive influx of renewables, as their dynamics require increasingly rapid responses, as evidenced by the major Spanish blackout last year. At the same time, this increased automation also means that these critical infrastructures increasingly depend on millions of smart meters, remote management systems, and other tools within reach of hackers.
"As connected devices extend beyond the meter, small vulnerabilities can accumulate and have repercussions on the system. Research indicates that hijacking less than 2% of the load of an electrical system, for example, through compromised smart meters, can destabilize the frequency," the report delves. In other words, even if the attacker were to gain control of only a small part of an electrical system, they could completely disrupt its operations and, in the worst-case scenario, cause a massive power outage.
The Agency's risk map highlights the immense dependence on China. Beijing controls between 60% and 85% of the five key clean energy technology supply chains (wind, photovoltaic, lithium batteries, heat pumps, and hydrogen electrolyzers), "a much higher level of concentration than that of oil, gas, and most other strategic products."
The exposure of green economies to the Asian giant has strong economic implications. According to the Agency's data, if China were to halt its battery exports for a month, it would cause $17 billion in losses to electric car factories in other regions, with the EU bearing half of the impact. Meanwhile, each month of interruption in Chinese component exports for solar energy would result in losses of $1 billion in photovoltaic module plants worldwide.
In this new stage, the threat goes beyond a physical supply cut, something that was already a risk in the era of hydrocarbons. For the IEA, the difference now is that cyber risk is a "constantly evolving systemic problem."
"Global supply chains introduce dependencies on hardware, firmware, and cloud services, as well as avenues for access to critical functions through compromised supplier equipment. This risk is no longer theoretical," the document warns.
As an example, the organization recalls that last year, US and EU authorities examined communication modules of imported solar inverters and batteries, warning of "the potential for large-scale remote manipulation." Another example: in 2024, Lithuania blocked remote access from Chinese providers to solar, wind, and storage energy control systems, citing national security reasons.
In Europe, around 200 gigawatts (GW) of installed photovoltaic capacity - enough to power all homes in Spain, Italy, and France combined - are connected to inverters manufactured in China. Approximately 75% of all new inverters come from the Asian giant.