A battery storage cyberattack would look exactly like a badly tuned controller
Batteries connected to the grid make money by reacting to frequency, pushing power out when it sags and soaking it up when it rises. A few hundred of them moving together, on command from someone who should not have the command, would look the same on a control room screen right up to the moment the network starts disconnecting customers. Rafael Narezzi, chief executive of the London firm Centrii, puts the number needed at 1,500 units in Texas, 5.4 percent of the ERCOT fleet, and 400 units in Great Britain, about 29 percent of the fleet there.
Those two percentages describe different problems. ERCOT runs roughly 28 GW of storage across about 28,000 one-megawatt units, so an attacker needs a thin slice of a very large fleet, with 30 million people and $12 billion to $65 billion in damage on the other side of it. Great Britain has about 6.8 GW across roughly 1,400 units, 79 percent of that sitting in England, and the modeled outcome is a national blackout hitting 67 million people at a cost of £2 billion to £10 billion. Getting in through a cloud platform is put at a 35 to 70 percent success rate over two to five weeks, at intermediate skill.
There is a much smaller number in the same research. Afzal and colleagues found in 2025 that a load-altering attack using 15 percent of a battery fleet’s power could push frequency outside normal operating bounds. Extrapolating from that research, Centrii estimates that 11 to 21 compromised 2 MW units could destabilize a regional grid.
That is two orders of magnitude below the 1,500 units cited for Texas, and the two figures sit in the same document without being reconciled. One of them is describing a regional test network and the other a whole interconnection, but if the smaller number is anywhere near right for a real grid, the campaign an attacker has to run is a great deal shorter than the capacity analysis implies.
The model puts the probability of at least one major attack affecting a million or more people by 2031 at 92.1 percent, dropping to 61.4 percent if operators are required to certify against IEC 62443, the industrial control system security standard, and to drill against the scenario every quarter. Read that number carefully. It is the output of 10,000 Monte Carlo runs seeded with assumed compromise rates, an assumed 15 percent annual gain in attacker capability, and 25 to 35 percent annual growth in installed storage. Nothing like this has happened yet, so the simulation is describing its own inputs at least as much as it is describing the grid.
The unit counts are the wrong number
Control of those 1,500 and 400 units is pooled. A much smaller set of third-party optimizers and manufacturer cloud platforms holds it, several of them dispatching hundreds of megawatts across sites owned by different firms. Britain’s system is secured to survive the sudden loss of 1,320 MW without breaching statutory frequency limits, with a higher ceiling for rarer events, beyond which the grid only has to hold frequency near 49.2 Hz for up to 60 seconds.
“That 1.8 GW is your shock absorber,” Narezzi told Help Net Security. “A coordinated swing materially past it walks frequency down toward the first LFDD stage at 48.8 Hz, and at that point the grid sheds demand automatically — the system does the damage, not the attacker.” Low frequency demand disconnection is automatic and indiscriminate: relays drop whole blocks of customers to stop the fall.
That reframes the target. “It’s the smallest set of control planes whose combined fast-acting MW exceeds the regional secured-loss ceiling,” Narezzi said. In ERCOT, which is larger, islanded and runs at 60 Hz, that ceiling is higher. Optimizers trade a battery’s output across power markets on the owner’s behalf, which means the login that earns the money is also the login that moves the megawatts. “For example, if you take one of many optimisers, such as KrakenFlex, they are cloud-based and could dispatch by logging into the cloud. Huge capacity can sit under one cloud base.”
What a control room would see
Not much. “A battery flipping from full charge to full discharge in under a second is exactly what these assets are paid to do under frequency response,” Narezzi said. “So the honest answer is that the frequency trace itself tells a control room nothing. A hostile swing and a revenue-driven one look identical on the wire.”
Narezzi has a candidate signature anyway. “A legitimate frequency-response asset behaves like a governor: it pushes against the deviation, it damps. The tell for a deliberate event is the opposite: active power phased to feed the disturbance instead of arresting it. Engineers have a name for that: a reverse governor.” So the hunt is for inverter output amplifying an oscillation at several sites at once, where the only thing those sites have in common is the platform dispatching them and nobody has logged a change to the control tuning. “Not the size of the swing. The phase of it.”
Spain took eleven months to rule out an attack
Spain’s grid collapsed on 28 April 2025. “The system ran a converter-driven forced oscillation at 0.63 hertz before it collapsed, and a 49-member expert panel took until March 2026—eleven months—to conclude it was oscillations, voltage control and protection. No cyberattack.” The problem is that the accident and the attack leave the same trace: “This is purposeful, so it hides inside the same investigation.”
Then there is the evidence problem. “The power plants that tripped first — the ones that started the whole thing — didn’t keep recordings of what happened. Their owners told investigators they simply had no data to hand over.” The ENTSO-E final report, published 20 March 2026, states that key data was missing for those plants and that investigators had to estimate the trigger. “If a real, accidental blackout leaves that little evidence behind, then a deliberate attack could be basically invisible.”
“Attribution needs OT forensics (e.g. command logs, provenance) that sit with the optimiser and the OEM, across a dozen private companies, not with the system operator,” Narezzi said. Operational technology forensics means the records of which commands reached physical equipment and who sent them, and those records live with the battery’s manufacturer and the platform trading it. His timeline runs seconds to ride the event through, hours to days before anyone suspects intent, and possibly never to confirm it. “That gap is the entire commercial problem. The failure lands before it’s named.”
Download: The ultimate guide to network operations management
