![\"Europe\u2019s](\"https:\/\/www.europesays.com\/europe\/wp-content\/uploads\/2026\/04\/nightlights_europe_north_africa_and_western_asia_at_night_by_viirs-300x300.jpg\")
\t\t\t\t\t\t<\/p>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/p>\n
European electricity infrastructure has become a target of sustained hybrid warfare, and a new report from Eurelectric, the region\u2019s power sector trade group, finds that most of the continent\u2019s utilities are not prepared for it.<\/p>\n
In a February 2026 report,\u00a0Battle-Tested Power Systems: Resilience and Preparedness for Europe\u2019s Electricity Sector<\/a>, Eurelectric documented an accelerating campaign of physical sabotage, cyberattacks, aerial intrusions, and subsea cable severances targeting energy assets across the European Union (EU). The findings arrive as European defense planners warn that Russia could move against North Atlantic Treaty Organization (NATO) allies as early as 2028, and as conflicts in the Middle East have shown, again, how quickly modern warfare destroys electricity infrastructure. In Europe, the timeline compresses the runway for utilities, regulators, and policymakers to act, the report warns.<\/p>\n \u201cAs the war approaches its fourth year,\u201d it says, \u201cthe strategy remains central to Russia\u2019s war effort, and the Sisyphean challenge of powering Ukrainian society during that time provides important insights for the rest of Europe on best practices to protect electricity infrastructure from attack.\u201d<\/p>\n The numbers are already staggering. Armed Conflict Location & Event Data (ACLED), an independent non-profit organization that claims to be \u201cthe world\u2019s most trusted source for real-time data and analysis on political violence and protest,\u201d\u00a0tallied 1,065 attacks<\/a>\u00a0on Ukrainian energy infrastructure through the end of 2024 in its Ukraine Conflict Monitor. World Bank damage estimates exceed $20 billion, the report says, even though it notes that precise attack figures remain incomplete in public records for security reasons. \u201cThis nonetheless implies that the data presented above are only the tip of a larger iceberg,\u201d the report says.<\/p>\n In 2025 alone, Ukraine sustained 1,225 attacks, which overshadowed the cumulative total of the prior three years. The bulk of the attacks were notably concentrated in the final four months. On Nov. 8, 2025, for example, a single strike deploying 450 exploding bomber drones and 45 missiles hit 25 locations simultaneously, cutting power across five regions. It was timed to maximize civilian exposure ahead of winter in a deliberate deployment of what it calls \u201cGeneral Winter,\u201d the report says.<\/p>\n Sabotage and Cyberattacks Expose Europe\u2019s Grid Vulnerabilities<\/p>\n Europe\u2019s grid has also taken direct hits, particularly on the Baltic Sea floor, which has become contested infrastructure. In November 2024, the Chinese-flagged Yi Peng 3 is suspected of dragging its anchor across two subsea data cable routes in the same transit\u2014severing the C-Lion1 fiber-optic link between Finland and Germany and the Arelion communications cable between Sweden and Lithuania. Six weeks later, on Christmas Day, the Eagle S\u2014a cargo vessel registered in the Cook Islands (a South Pacific flag of convenience jurisdiction favored by operators seeking to obscure ownership and dodge sanctions)\u2014cut the Estlink-2 power cable in the Gulf of Finland. While Estonian authorities pegged the repair bill at up to \u20ac60 million, Eurelectric noted the figure covered neither the lost transmission capacity nor necessary security measures spearheaded by NATO\u2019s Baltic Sentry mission, which was tasked in January 2025 to specifically patrol the sea lanes. While aerial incursions over Poland, Romania, and Estonia in September 2025\u2014including Russian fighter jets holding position in Estonian airspace for 12 minutes before NATO escorts arrived\u2014did not cause direct damage to power infrastructure, they highlighted more crucial vulnerabilities.<\/p>\n And beyond physical attacks, London-based geopolitical and security intelligence firm Dragonfly Intelligence tallied 23 successful cyberattacks on Europe\u2019s energy sector from the start of the war in Ukraine to October 2024 alone. On the first day of Russia\u2019s 2022 invasion, a suspected Russian cyberattack disabled remote monitoring via satellite for 5,800 German wind turbines\u2014representing 11 GW of capacity across operators including Enercon, one of Europe\u2019s largest turbine manufacturers.<\/p>\n Sandworm, a unit of Russia\u2019s military intelligence agency (GRU), is suspected in the most extensive cyberattack Denmark has ever experienced\u2014a May 2023 campaign that compromised 22 energy companies by exploiting vulnerabilities in Zyxel firewalls, including zero-days in the second attack wave, forcing affected operators into island mode. Attribution, however, remains disputed.<\/p>\n Between Dec. 29 and Dec. 30, 2025, hackers penetrated Polish energy infrastructure, gaining access to combined heat and power plants, and renewable generation management systems, though the attack was successfully defended, avoiding a blackout. Perhaps more concerning is that in April 2025, hackers exploited a weak password in an industrial control system to open the water valve at Norway\u2019s Lake Risevatnet dam to full capacity. The reservoir drained, and while the physical damage was limited, \u201cThe uncertainty such actions sow is an arguably more valuable outcome than any real damage caused,\u201d the report says.<\/p>\n \u201cThe geopolitical picture has developed,\u201d Markus Rauramo, Eurelectric\u2019s president,\u00a0said ahead of the report\u2019s release.<\/a>\u00a0\u201cNow there are more scenarios that we ought to take seriously and prepare for. For me it is not either\/or. These are on a sliding scale\u2014from the traditional risk of asset unavailability or grid instability to low probability but high impact potential of hybrid or cyber or even kinetic, with hostile actors trying to impact our availability.\u201d<\/p>\n 1. Russia\u2019s attack tactics against Ukraine\u2019s energy infrastructure have evolved through three distinct phases since the February 2022 invasion, spanning grid disconnection and occupation, to targeted generation asset strikes, to the massive combined drone-and-missile barrages that have dominated since late 2024. Cyberattacks have persisted across all three phases. Courtesy: Eurelectric, Battle-Tested Power Systems, February 2026.<\/p>\n Eurelectric\u2019s analysis suggests Russia\u2019s tactics evolved through three distinct phases (Figure 1). Artillery shelling gave way to drone and missile warfare, including Iranian-made Shahed drones\u2014low-cost, GPS-guided one-way attack aircraft that detonate on impact, which Russia now mass-produces domestically under the designation Geran-2\u2014and increasingly precise \u201cdouble-tap\u201d strikes. These are drones launched in volume to breach physical fortifications, followed by precision missiles to destroy the equipment behind them.<\/p>\n During the Ukraine War, initial focus on transmission substations shifted to centralized generation assets once Ukraine demonstrated it could reconnect a fragmented grid, the report says. By September 2023, more than 6,500 missiles and 3,500 drones had destroyed approximately 50% of Ukraine\u2019s energy infrastructure and more than 67% of its thermal generation capacity, according to the Centre for Global Studies. The most recent phase, since September 2025, has been the most destructive. \u201cThe sheer number of munitions used means even with a 60\u201370% shoot-down rate, the few that get through remain fatal,\u201d DTEK told Eurelectric.<\/p>\n The two most targeted assets, notably, have been gas compressors and primary electrical transformers, which are likely chosen for their system-critical role and long procurement lead times. Cyberattacks, meanwhile, have occurred constantly throughout all three phases, increasing 30% to 40% since the invasion began, according to DTEK, and are now accelerating given an artificial intelligence-driven arms race between Russian offensive models and Ukrainian defensive systems.<\/p>\n Significantly, the report draws a clear operational boundary between military defense of assets, which is the state\u2019s responsibility, and preparedness, which is the utility\u2019s. \u201cThe onus nonetheless falls on power companies to practice effective preparedness,\u201d it says, \u201ccentering around three phases: preparation, response and recovery.\u201d<\/p>\n \u201cI would focus on three points: situational awareness\u2014understanding the geopolitical picture and the threat picture you are facing,\u201d Rauramo said. \u201cThen have good authority contacts, so have a two-way communication continuously. And then exercise. You become a master by practicing and exercising.\u201d Resilience Under Fire: How Ukraine\u2019s Energy Sector Is Adapting\u2014and What It Means for Europe, a June 2025 analysis of infrastructure attacks, published by advisory firm Rasmussen Global, analyzed Russia\u2019s attack patterns in Ukraine and identified physical hardening measures, he noted. \u201cWhat we can take from that report is what a hostile actor is targeting and what kind of damage and disruption is inflicted on potentially our assets\u2014and then actually play that back to our situation. What kind of stockpile should we have? What kind of spares are in this critical infrastructure? And then think even further about lead times and availability of the parts that could be impacted.\u201d<\/p>\n Physical hardening, which could include gabions, sandbags, concrete shielding, and drone nets, is the cheapest and most widely deployed form of protection, the Eurelectric report says. The cost calculus points to critical nodes: a nodal substation aggregating hundreds of megawatts is a more defensible investment than individual turbines, it argues. Transformer stockpiles will also be essential, though their locations must be kept secret and decentralized. Notably, Ukraine\u2019s energy ministry pioneered a \u201cMobile Brigade\u201d to recover usable equipment from decommissioned assets across Europe\u2014a procurement template the report recommends to European operators.<\/p>\n DTEK\u2019s response has also been instructive. Anticipating the capture of one of its thermal power plants, the utility disassembled the entire facility before the final attack, retrofitting recovered equipment into other plants still operating. That approach \u201ccan sometimes be more pragmatic to repair equipment, rather than prevent damage with expensive asset fortifications,\u201d the report says.<\/p>\n Ukraine\u2019s recovery has meanwhile relied heavily on its national energy and climate plan, which targets a 27% distributed energy resource share by 2030, treating decentralization as a security imperative. DTEK opened 200 MW of battery storage in September 2025, deliberately spread across six sites to reduce the impact of any single strike, using batteries supplied by Fluence. \u201cIn the EU, we cannot afford to wait and see,\u201d the report concludes.<\/p>\n EU Directives and NATO Spending Drive Push for Grid Hardening<\/p>\n In the EU, so far, the legislative framework appears substantive. The\u00a0Critical Entities Resilience (CER) Directive<\/a>, the\u00a0Network and Information Security Directive 2 (NIS2)<\/a>, and the\u00a0Electricity Market Design Reform<\/a>\u00a0collectively mandate risk assessment, physical site protection, operational technology (OT)-information technology (IT) cybersecurity segmentation, and shock-absorption capabilities. The problem is clearly delivery: While CER required national transposition by October 2024,\u00a0numerous member states missed that deadline<\/a>. \u201cProgress across Europe\u2019s power sector remains a patchwork of different levels of preparedness, with TSOs [transmission system operators] and DSOs [distribution system operators] respecting different levels of guidance depending on their country,\u201d the report says.<\/p>\n The urgency for action, however, remains considerable. Eurelectric\u2019s benchmark survey asked European utilities to rate their own preparedness for hybrid threats and crisis scenarios on a 10-point scale, where 1 meant preparedness was not considered at all and 10 meant readiness for any crisis that could occur. Responses averaged 6.7. And yet, the report is explicit that this overstates the reality, given that only the more preparedness-conscious utilities chose to participate.<\/p>\n As outliers, Nordic and Baltic operators treat hybrid risk as an operational reality, it says. Finland\u2019s Total Defense model, coordinated through the National Emergency Supply Agency (NESA), embeds Fingrid\u2014the Finnish TSO\u2014directly into national defense planning through joint exercises, classified briefings, and compulsory stockpile oversight. Still, contact between utilities and national authorities across the broader sector is largely informal and flows in one direction. \u201cThis dependence on informal channels and a lack of two-way information sharing highlights a structural weakness,\u201d the report says.<\/p>\n On financing, Rauramo was direct. \u201cIn order to really prepare, you need to reinforce your critical infrastructure\u2014transformer stations, critical power plants. You need to build underground operating rooms. You need personal protective equipment, sandbags, plywood. This is certainly already defense-related spending.\u201d Awareness is critical, he suggested. \u201cWe certainly as a critical infrastructure provider can point to the authorities that this could be part of the 1.5% spending for NATO compliance.\u201d<\/p>\n NATO-allied countries have agreed to raise defense spending to 5% of gross domestic product (GDP), of which 1.5 percentage points are earmarked for critical infrastructure protection and cybersecurity. For now, Eurelectric estimates the pool at approximately \u20ac250 billion. However, the governance mechanism to direct that capital specifically to grid hardening does not yet exist. On shared responsibility, Rauramo offered the Nordic model as a template. \u201cWhen everybody chips in a little bit, we get big impact. We cannot rely on one party taking the whole responsibility.\u201d<\/p>\n \u2014Sonal Patel<\/a>\u00a0is senior editor at POWER magazine (@sonalcpatel<\/a>,\u00a0@POWERmagazine<\/a>).<\/p>\n \t\t\t![\"\"](\"https:\/\/www.europesays.com\/europe\/wp-content\/uploads\/2026\/04\/fig1-ukraine-tactics-eurelectric-c.jpg\")
<\/p>\n