BlastWaveBlastWaveHACKOPEDIA
Hackopedia • Energy edition
12 files

Cyberattacks on the Power Grid and Energy Sector: The Verified Record

Volume 212 entries167 sources citedAll verified since Updated

The Energy edition of Hackopedia: twelve incidents at electricity, heating and energy supply operations and their suppliers, from 2014 to 2026. Each entry separates what is verified from what is only reported or unknown.

Summary

Hackopedia's Energy edition covers twelve incidents from 2014 to 2026. Two caused power outages on the record, both in Ukraine: about 225,000 customers for several hours in December 2015, and about 200 MW in Kyiv in December 2016. Heating stopped in part of Lviv in January 2024. Elsewhere, power and heat stayed on or no physical effect is confirmed.

The twelve incidents in the Energy edition

Sorted by file number. The tag says how far the public record goes, not how serious the incident was.

File 003 · 2015Ukraine Power Grid Cyberattack (2015)Ukraine

Remote intruders opened substation breakers at three distribution companies, cutting power to about 225,000 customers for several hours; crews restored it by hand.

GRU unit, per EU sanction and US indictmentFile 017 · 2025Polish Hydropower Plant Incident (2025)Northern Poland (plant unconfirmed)

A hacktivist video showed a small hydropower plant's control screen operated until its generator stopped; no one has confirmed which plant, or that anything physical happened.

Claimed by video; unconfirmedFile 020 · 2016Ukrenergo Kyiv Power Grid Cyberattack (2016)Kyiv, Ukraine

Breakers opened at the Pivnichna substation north of Kyiv, cutting about 200 MW; operators restored power by hand in about an hour and a quarter.

GRU unit, per US-UK advisoryFile 028 · 2025Poland Distributed Energy Cyberattack (2025)Poland

An attacker disabled field devices at more than thirty wind and solar farms and struck two combined heat and power plants; generation continued and heat was never interrupted.

Attributed by the UK with EU statesFile 030 · 2022Viasat KA-SAT Cyber Attack and Enercon Wind Turbines (2022)Europe

An attack on Viasat's KA-SAT network wiped modems across Europe; about 5,800 Enercon turbines lost remote monitoring and control but kept generating.

Attributed to Russia by EU, UK and USFile 031 · 2023Danish Energy Sector Zyxel Firewall Attacks (2023)Denmark

Attackers compromised Zyxel firewalls at 22 energy companies in two waves; operators cut internet links and kept running, with no loss of power or heat on the record.

UnattributedFile 032 · 2025Nova Scotia Power Ransomware Attack (2025)Nova Scotia, Canada

Ransomware hit the utility's business network; generation and the grid were not disrupted, but meter readings could not reach the utility, so most bills were estimated.

Attacker undisclosedFile 033 · 2026Itron Cyber Incident (2026)Global (utility supplier)

A metering supplier disclosed unauthorized access to certain systems, later including limited access to certain customer-hosted systems; neither filing mentions meters or the grid.

Attacker undisclosedFile 041 · 2022Industroyer2 Attempted Attack on Ukrainian Substations (2022)Ukraine

Malware loaded with substation device addresses was scheduled to run; officials said defenders prevented outages, and what stopped it has never been published.

Attributed by CERT-UA to SandwormFile 043 · 2024FrostyGoop and the Lviv Heating Incident (2024)Lviv, Ukraine

324 heat points in one district stopped and crews restarted them by hand; Dragos later linked FrostyGoop malware to the attack by assessment.

Malware link by Dragos assessmentFile 047 · 2014Havex / Dragonfly Cyber Espionage Campaign (2014)European software suppliers

Installers on three small European industrial software suppliers' websites were swapped for copies carrying a remote access trojan that scanned for OPC servers; no record shows it touched a process.

Officers charged, never triedFile 049 · 2023Volt Typhoon Intrusion at Littleton Electric Light and Water (2023)Littleton, Massachusetts, US

Intruders the FBI identified to the utility as Volt Typhoon were in a small public utility's IT network; no primary source places them in its control systems.

Volt Typhoon, per the FBI's notification

Energy sector cyber incidents by year and record status

YearIncidentWhereRecord status
2015Ukraine Power GridUkraineGRU unit, per EU sanction and US indictment
2025Polish Hydropower PlantNorthern Poland (plant unconfirmed)Claimed by video; unconfirmed
2016UkrenergoKyiv, UkraineGRU unit, per US-UK advisory
2025Poland Distributed EnergyPolandAttributed by the UK with EU states
2022Viasat KA-SAT / EnerconEuropeAttributed to Russia by EU, UK and US
2023Danish Energy SectorDenmarkUnattributed
2025Nova Scotia PowerNova Scotia, CanadaAttacker undisclosed
2026ItronGlobal (utility supplier)Attacker undisclosed
2022Industroyer2UkraineAttributed by CERT-UA to Sandworm
2024FrostyGoopLviv, UkraineMalware link by Dragos assessment
2014HavexEuropean software suppliersOfficers charged, never tried
2023Volt Typhoon / LittletonLittleton, Massachusetts, USVolt Typhoon, per the FBI's notification

What the headlines got wrong about energy sector cyberattacks

One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.

Widely repeated claimWhat the record saysEntry
"BlackEnergy malware caused the Ukraine blackout."The US alert said BlackEnergy's role was not known, ICS-CERT said it could not confirm a causal link, and the E-ISAC and SANS analysis said neither BlackEnergy 3 nor KillDisk could cause the outage. People opened the breakers through the operators' own software.Ukraine Power Grid
"Russian hackers attacked the hydropower plant in Tczew."Tczew was CyberDefence24's "could have been," disputed in its own updates on 18 and 20 August 2025. No operator, authority or court has named a site.Polish Hydropower Plant
"A fifth of Kyiv losing power."The operator said about 200 MW, "equivalent to about a fifth of the capital's energy consumption at night": a share of night-time load, not of people. The UK's GRU profile converts one into the other.Ukrenergo
"Poland came very close to a blackout."A minister's answer to a radio interviewer in mid January 2026. No technical document supports it; the transmission operator told CERT Polska the system's stability was not affected.Poland Distributed Energy
"Satellite outage knocks out thousands of Enercon's wind turbines."The turbines lost remote monitoring and control and kept running in automatic mode. The body of the same story carried Enercon's statement saying so.Viasat KA-SAT / Enercon
"Russian Hacking Group Sandworm Linked to Unprecedented Attack on Danish Critical Infrastructure." (Infosecurity Magazine headline)SektorCERT found "no evidence to accuse Russia." The indicators are two single packets to addresses it linked to Sandworm, and no government has attributed this incident, as of late September 2026.Danish Energy Sector
"The cyberattack disconnected Nova Scotia Power's meters."The meters "continued to function and gather accurate energy usage data." What failed was the path that carried their readings to the utility.Nova Scotia Power
"Itron's smart grid systems were breached."Neither filing mentions meters, networks, the grid or operational technology. The amendment says "certain customer-hosted systems," a term it does not define.Itron
"In 2022, the Russian hacker group Sandworm initiated a blackout in Ukraine using a variant of Industroyer aptly dubbed Industroyer2." (Wikipedia, Industroyer article)Ukrainian officials said defenders prevented electrical outages. The sentence has stood since 13 April 2022 and was live on 27 September 2026; the Wired article it cites is headlined "Russia's Sandworm Hackers Attempted a Third Blackout in Ukraine," and Wikipedia's own Sandworm article says "attempted." The outage that did happen was in October 2022, with different tools.Industroyer2
"FrostyGoop cut heat to 600 apartment buildings for two days."That is Dragos's account. The city reported heating back in every Sykhiv building by 15:00 the same day, and the SBU said more than 600 households, quickly neutralized. Scale and duration are disputed.FrostyGoop
"Havex crashed OPC servers at plants."The only record is ICS-CERT's testing, a laboratory observation about the tool. No field crash has been published.Havex
SecurityWeek, March 2025, reporting Dragos: "the hackers had been in the organization's network since February 2023, for more than 300 days."Dragos speaking to reporters, not its published case study. On Dragos's own dates, a February start and a November discovery, the count comes to at most 289 days, short of 300 unless counted to eviction in December.Volt Typhoon / Littleton

BlastWave analysis: restored by hand

Analysis, not a disclosed fact

Across the twelve entries, the incidents that reached the physical system on the record, Ukraine in 2015 and 2016 and Lviv in 2024, ended the same way: people restored power or heat by hand. Several of the others turn on equipment at the edge of the network, such as firewalls, satellite modems, cellular gateways and field devices, rather than on the control room. That is BlastWave's reading of the record, not a finding of any investigator. It is why the entries' recommendations focus on removing exposed remote paths and on keeping the ability to run by hand.

Frequently asked questions

What are the major cyberattacks on power grids and energy companies?

The Energy edition documents twelve: Havex (2014), the Ukraine power grid attack (2015), Ukrenergo in Kyiv (2016), the Viasat KA-SAT attack that cut remote access to Enercon wind turbines (2022), Industroyer2 (2022), the Danish energy sector firewall attacks (2023), Volt Typhoon at Littleton, Massachusetts (2023), FrostyGoop and the Lviv heating incident (2024), Nova Scotia Power (2025), a Polish hydropower plant (2025), Poland's distributed energy (2025) and Itron (2026).

Has a cyberattack ever caused a blackout?

Yes, in Ukraine. On 23 December 2015 remote intruders opened substation breakers at three distribution companies, cutting power to approximately 225,000 customers for several hours. On 17 December 2016 breakers opened at Ukrenergo's Pivnichna substation north of Kyiv, cutting about 200 MW for about an hour and a quarter. In April 2022 Ukrainian officials said defenders prevented outages from Industroyer2. No other entry in this edition records a power outage.

Who was behind the Ukraine power grid attacks?

The US Justice Department charged six officers of Russia's GRU Unit 74455 on 19 October 2020 for conduct including the December 2015 to December 2016 attacks on Ukraine's grid; they are charged, not convicted. The EU sanctioned the GRU's Main Centre for Special Technologies for the 2015 attack in July 2020. CERT-UA attributed Industroyer2 in 2022 to Sandworm.

Did Volt Typhoon get into a US utility's control systems?

At Littleton Electric Light and Water Departments, a small Massachusetts public power and water utility, intruders the FBI identified to the utility as Volt Typhoon were in its IT network in 2023. The FBI notified the utility in November 2023 and the intruders were out by December. No primary source places them in its control systems, and when the intrusion began is disputed.

Have hackers attacked wind and solar farms?

On 24 February 2022, an attack on Viasat's KA-SAT satellite network left about 5,800 Enercon wind turbines without remote monitoring and control; they kept generating in automatic mode. On 29 December 2025, according to CERT Polska, an attacker disabled field devices at more than thirty wind and solar farms in Poland; generation continued.

How does Hackopedia verify an energy sector incident?

Every figure, date and quotation in an entry traces to a court record, a government, regulator or national CERT document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Claims resting on press or unnamed sources are marked as reported, and vendor assessments are labelled as assessments, not findings.

Other editions

WaterOil and GasManufacturingFood, Beverage and RetailTransportation and LogisticsStuxnet

Cite this page

BlastWave. “Power Grid and Energy Cyberattacks: The Verified Record (2014 to 2026).” Hackopedia, Volume 2, Energy edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/

Revision history

DateChange
5 Oct 2026Energy edition published with twelve entries. FILE numbers run across all of Hackopedia Volume 2, not by edition.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry