A cybersecurity specialist has warned that Europe should expect successful cyberattacks against its

A cybersecurity specialist has warned that Europe should expect successful cyberattacks against its energy infrastructure over the next five years, even if a nationwide blackout triggered by a single click remains far less probable, L’Express reported. Tomislav Vazdar, founder and CEO of the consulting firm Riskoria, which advises companies and institutions on cyber and AI risks, anticipates a multiplication of attacks targeting renewable energy sites and heating installations — and says not all of them can be stopped.

The warning comes as Europe has already experienced such an attack. On Dec. 29, 2025, in the middle of a cold wave, hackers struck dozens of wind and solar farms in Poland, along with a large cogeneration plant supplying homes with heat and electricity, disabling numerous control units linking the sites to grid operators’ systems. Power kept flowing, but operators lost contact with their sites. In July 2026, the EU and the United Kingdom officially attributed the attack to a unit of Russia’s FSB security service.

How the Poland attack unfolded, months in the making

The intrusion method was anything but sophisticated, Vazdar said. The hackers used remote-access portals left open on the internet without two-factor authentication, then targeted industrial equipment still running on factory-default passwords. Suspicious activity had been spotted on the plant’s network months earlier — a textbook case of what France’s cybersecurity agency ANSSI calls “pre-positioning”: getting in quietly today to strike tomorrow.

Three sectors are particularly exposed, in Vazdar’s view. Renewable energy, because it consists of thousands of small remotely managed sites, often through the manufacturer’s online platform — in October, a group of experts set up by the European Commission warned that a single hacked platform could give attackers simultaneous access to a large number of solar inverters. Heating installations are also a target, as are small hydroelectric plants; in 2024, a group linked to Russian military intelligence took control of a micro-hydroelectric plant in a French village, apparently believing it was a dam.

Why nuclear plants are hard targets — and still an indirect risk

No installation is immune, Vazdar said, but a nuclear plant is one of the hardest targets in the energy system, and that is not where the main danger lies. The systems that shut down a reactor and ensure its cooling are isolated from external networks, and the most fundamental safety measure is physical: in French pressurized-water reactors, control rods drop into the core under their own weight.

Subcontractors, laptops and USB drives remain potential entry points — the attack on an isolated Iranian enrichment plant showed that isolation alone is not enough. Still, an intrusion is far more likely to cause a costly shutdown than a radiological accident. The real risk is indirect: a reactor depends on the grid it feeds. When the Iberian Peninsula lost power on April 28, 2025, in a general outage caused mainly by voltage-control failures rather than hackers, Spain’s operating reactors shut down automatically and stayed safe. That is how the system is supposed to work. But for a country as dependent on nuclear power as France, losing a large share of production within seconds would itself be a national crisis — and an attacker would not need to hit a reactor directly to cause one.

Basic fixes exist, but the weak links are the small operators

Protection measures capable of sharply reducing the threats do exist, Vazdar said. The known best practices include keeping industrial equipment off the internet, requiring two-factor authentication for every remote connection including at subcontractors, changing default passwords before connecting a device to a network, and updating or replacing equipment whose manufacturer no longer provides support.

Poland showed these measures can make the difference: during the attack on the thermal plant, security software stopped the malware on more than 100 computers where it had already begun to act, and a control station with its own password rather than the factory one resisted the hackers’ guessing attempts.

France protects its largest operators well — since the 2013 military programming law, operators of vital importance, including major energy companies, have been subject to binding security rules supervised by ANSSI. The weak link is the smaller players multiplying with the energy transition: solar and wind farm operators, installers, maintenance companies, and manufacturers whose platforms remotely run the installations. In such an environment, threats cannot be eliminated 100%; a determined state actor will always find a way in somewhere. The goal is to ensure one breach does not turn into a hundred.

Europe’s rules are solid on paper; France’s transposition is stalled

On paper, Europe and France take the issue seriously, Vazdar said, but in practice it is more complicated. The EU has a solid framework: the NIS2 directive extends security obligations to medium and large energy companies, a dedicated electricity cybersecurity code is being set up, and the Commission has moved to exclude high-risk suppliers’ inverters from EU-funded projects. France has one of Europe’s most competent cybersecurity agencies, but the “Résilience” law meant to transpose NIS2 into French law is stalled. The Senate adopted it in March 2025; the debate scheduled in the National Assembly in October 2026 was canceled the day before, and a new date remains uncertain. In July 2026, the European Commission referred France to the Court of Justice of the EU over the delay. Until the text is adopted, thousands of companies are not required under French law to comply.

Attacks on supermarkets showed why this matters: the weak point was not a large closely monitored operator but equipment nobody really watched, maintained by subcontractors. Energy production poses the same problem, with thousands of small remotely managed sites. Rules applying only to big operators protect the castle while attackers come in through the service door.

What the next five years could look like

Successful attacks against energy installations are very likely over the next five years, Vazdar said; a nationwide power outage triggered by a single click is much less so, because European grids have significant safety margins. What is realistic is a series of local attacks on heating plants, solar and wind farms, storage sites and, above all, the companies that maintain them.

A plausible scenario resembles the supermarket campaign: on a freezing January evening at peak demand, hackers who spent months infiltrating a manufacturer’s online platform send the same command simultaneously to thousands of installations, disconnecting solar inverters and domestic batteries. Taken individually, each site is insignificant; together, they create a sudden imbalance the grid operator must absorb within seconds, possibly by cutting power in some areas. At the same time, a heating plant in a mid-sized city sees its control computers fail, leaving residents without heat until engineers restart it manually.

The question for the next five years is not whether hackers will try their luck, Vazdar concluded, but whether thousands of small energy operators will close the most basic gaps before someone exploits them at the worst possible moment.

Questions readers are asking

• Has Europe already suffered a cyberattack on its energy system? Yes. On Dec. 29, 2025, hackers disabled control units at dozens of Polish wind and solar farms and a cogeneration plant during a cold wave; in July 2026 the EU and UK attributed the attack to an FSB unit.
• Are nuclear plants safe from hackers? They are among the hardest targets because shutdown and cooling systems are isolated and control rods drop by gravity, but subcontractors and USB drives remain entry points, and the bigger risk is indirect — losing grid power can force reactors offline, as happened in Spain on April 28, 2025.
• What can actually reduce the risk? The fixes are known and basic: keep industrial equipment off the internet, require two-factor authentication, change default passwords and update unsupported equipment. Poland’s defenses stopped malware on over 100 computers during the December 2025 attack.
• Is France legally behind on cybersecurity rules? The NIS2 transposition law passed the Senate in March 2025 but the National Assembly debate planned for October 2026 was canceled, and in July 2026 the European Commission took France to the EU Court of Justice over the delay.
• Could a cyberattack cause a national blackout? Vazdar says that scenario is much less likely than a series of successful local attacks, because European grids carry large safety margins.

The open question remains whether the thousands of small operators across Europe’s renewable and heating infrastructure will close elementary security gaps before a coordinated attack turns one neglected flaw into a mass effect on a freezing winter night.