A coordinated cyberattack on grid-connected battery storage could disguise itself as normal frequency-response behavior and trigger automatic load shedding before operators realize it is malicious. The analysis highlights how cloud-based optimizers, missing OT data, and slow attribution could make attacks on ERCOT and Great Britain difficult to detect and potentially highly disruptive. #ERCOT #GreatBritain #IEC62443 #KrakenFlex #ENTSOE
Keypoints
- Grid batteries can be abused by making them react as if they were providing normal frequency support.
- Thousands of units in ERCOT or hundreds in Great Britain could be enough to cause major disruption.
- Cloud-based optimizers and manufacturer platforms concentrate control over large amounts of battery capacity.
- A hostile power swing may look identical to legitimate frequency-response activity in a control room.
- Missing OT logs and slow investigations make it hard to prove whether a blackout was caused by an attack.
Read More: https://www.helpnetsecurity.com/2026/09/02/grid-battery-storage-cyberattack/