Hackers have attacked three German wind energy companies since Russia's war in Ukraine, shutting down 2K+ turbines' remote control systems for a day, and more
Catherine Stupp / Wall Street Journal :
Context & Ripple Effects
Russia's grid-hacking campaign has been migrating west for years: the unprecedented hack of Ukraine's power grid in 2016 demonstrated mass outages were achievable, and the US grid intrusion from 2016 to 2018 showed the same actor working through contractors and trade publications to reach Western infrastructure. Mandiant later tied Sandworm to a third successful attack on Ukraine's electric utility in October 2022, timed with missile strikes.
The WSJ report on three German wind companies losing remote control of more than 2,000 turbines for a day extends that arc into Western Europe's renewable fleet — and, notably, targets the remote-management layer rather than causing blackouts.
First-order effects
- Three German wind operators spent a day running 2,000+ turbines without remote-control systems, forcing manual or local operation and exposing how dependent modern wind fleets are on networked management software.
Second-order effects
- European wind farm operators and their SCADA vendors now face pressure to harden or segment remote access — the same contractor-and-supplier pathway the US grid attackers used — while German and EU regulators gain a concrete case for stricter critical-infrastructure rules covering renewables.
Third-order effects
- As Wired's analysis of why real grid disruptions are rare suggests, attackers who can't easily take down transmission grids may settle for degrading peripheral control layers like turbine fleets — making renewables' operational software a standing target in hybrid conflict between Russia and NATO states.
The trend: Russian-linked cyber operations are expanding from Ukrainian utilities toward Western European energy infrastructure, with wind and other renewables' remote-control systems emerging as a new attack surface.