Analysis Warns Coordinated Attacks on Grid Batteries Could Trigger Automatic Load Shedding
Summary
A Centrii analysis says attackers could exploit cloud-controlled grid batteries to amplify frequency disturbances and trigger automatic load shedding. Missing OT logs could hinder attribution; its modeled risks rely on assumptions, and no such attack has occurred.
Key points
- Centrii CEO Rafael Narezzi estimates that 1,500 battery units in ERCOT or 400 in Great Britain could cause major disruption; a separate regional-network estimate of 11–21 compromised 2 MW units is not reconciled with those figures.
- The model estimates a 92.1% chance of a major attack affecting at least one million people by 2031, falling to 61.4% with IEC 62443 certification and quarterly drills. These results come from 10,000 simulations based on assumed compromise rates, attacker growth, and storage growth.
- Cloud-based optimizers and manufacturer platforms can control battery capacity across multiple sites, concentrating access that could otherwise require compromising many individual units.
- A hostile battery response could resemble legitimate frequency support. Narezzi suggests looking for inverter output that feeds rather than damps a disturbance—the proposed “reverse governor” pattern—across sites sharing a dispatch platform.
- A 49-member panel concluded Spain’s April 2025 grid collapse resulted from oscillations, voltage control, and protection issues, not a cyberattack. Missing plant recordings meant investigators had to estimate the trigger.
- Command logs and other OT forensic records are held by optimizers and equipment manufacturers, according to Narezzi, potentially leaving grid operators unable to quickly establish whether a disturbance was deliberate.
Article Details
- Event Type
- Analysis of a hypothetical coordinated cyberattack on grid-connected battery storage, based on modeled scenarios; no such attack is reported to have occurred.
- Impact
- Coordinated control of battery storage could amplify grid frequency disturbances and trigger automatic load shedding, potentially causing widespread outages. The analysis estimates that 1,500 units in Texas or 400 in Great Britain could cause major disruption, while a separate extrapolation suggests 11 to 21 compromised 2 MW units could destabilize a regional grid. These are modeled estimates with differing scopes, not confirmed attack outcomes. The article also highlights that missing operational technology records could hinder detection and attribution.
People
AfzalCited with colleagues as having found in 2025 that a load-altering attack using 15 percent of a battery fleet’s power could push frequency outside normal operating bounds.Rafael NarezziChief executive of Centrii; provided estimates and analysis of potential attacks on grid-connected battery storage.