Battery storage cyber attack 'could cause national blackout' and £10bn in damage

Thank you for subscribing!

Prolonged instability would trigger equipment damage, load-shedding and, eventually, large-scale blackouts

A cyber attack on Britain's battery storage systems could trigger a national blackout and cause £10billion in damage, a report warns.

Experts at Centrii, an energy cybersecurity specialist, believe that there is a 90 per cent chance that hackers will attempt such an attack within the next five years.

The Centrii team war-gamed an assault on Battery Energy Storage Systems (BESS), in both the UK and in Texas.

The BESS units will play an increasingly key role in Net Zero as they can provide a certain amount of flexible power when, for example, the wind isn't blowing.

But they are important to the energy system not just because they store power but because they help keep the grid stable. Britain's grid is designed to run at 50hz.

A shortage of energy – for example, if a power plant trips – will lower the frequency. BESS units are able to step in to rectify this.

If frequency rises because too much energy is being generated, batteries can store this power temporarily and dispatch it when needed.

But these same capabilities could be exploited by hostile actors, according to Rafael Narezzi, chief executive of Centrii.

His team proposed a scenario called Gridlock, which involves a coordinated cyber attack on multiple BESS units.

After gaining control via cloud vulnerabilities, the hackers would either charge or discharge energy, causing the frequency of the grid to deviate.

Prolonged instability would trigger equipment damage, load-shedding – where power is cut to certain areas – and, eventually, large-scale blackouts.

"Unlike traditional cyber attacks targeting data confidentiality or availability, Gridlock weaponises the physical properties of energy storage to create cascading grid instability," says Mr Narezzi.

"It is a coordinated cyber-physical attack in which adversaries compromise multiple BESS units and orchestrate synchronised charge/discharge cycles to destabilise electrical grid frequency."

Centrii ran a 'Monte Carlo' simulation that saw 10,000 versions of a hypothetical attack executed.

It modelled assaults on the UK grid and the larger storage network in Texas.

Overall, it estimated that, if current security is not tightened, there is a 92 per cent probability of such an attack by 2031.

Aggressive security measures lowered that probability to 61 per cent. In terms of impact, the test found that a targeted attack on 27 per cent of the UK's BESS capacity could be enough to trigger a national blackout. This would cause up to £10billion of damage.

In Texas, compromising just over five per cent of BESS was enough to destabilise the entire grid. Economic damage could near £50billion.

The report recommends mandatory minimum security on BESS systems with quarterly attack drills.

Securing BESS infrastructure could cost up to £1billion, it claims, but the report's authors say this is far less than the cost of an attack.

Mr Narezzi says: "The decentralised energy transition is creating the attack surface for Gridlock.

"The question is not whether such an attack will occur, but when – and whether critical infrastructure operators, regulators and policymakers will act before the first blackout or after."

The issue of energy security hit the news when a cyber attack caused a small-scale British generator to be temporarily shut down in July.

Hackers linked to Iran were blamed and the plant was shut for four days as a result of the attack. The Government said that at no point was there a risk to the wider energy system.

In response to the Centrii report, it said that critical operators on the energy system were already required to meet "clear cyber resilience standards".

These regulations are being updated by the Cyber Security and Resilience Bill, which is currently in Parliament.

The measures in the bill are targeted at organisations whose compromise could have a significant impact on grid stability, it said.

It added that it was continually assessing the "evolving threat landscape".

A spokesman said: "The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.

"We are alive to growing cyber security threats and are driving legislation through Parliament to introduce new powers to tackle threats to our national security."