Critical Infrastructure Under Siege: The Escalating OT and Energy Cybersecurity Threat Facing Europe in 2026

Europe’s operational technology (OT) infrastructure, the industrial control systems and networks that keep power grids live, pipelines pressurised, and water treatment plants functioning, is under sustained, sophisticated attack. This is no longer a theoretical risk confined to cybersecurity conference slides. Since 2022, documented incidents involving energy operators in Germany, Denmark, Finland, and the Baltic states have confirmed that state-aligned threat actors are targeting the physical systems that underpin economic stability and national security. For European corporate directors and government ministers, the strategic and legal implications are immediate.

Why This Matters: OT Cybersecurity Is Now a Board-Level Issue

Operational technology, meaning the hardware and software that monitors and controls physical industrial processes, was historically “air-gapped” from internet-connected IT systems. That separation no longer exists in most modern critical infrastructure, and the attack surface has expanded dramatically as a result.

Key dimensions of the threat for European leaders:

* Operational disruption risk: A successful OT cyberattack can physically damage equipment, cause extended outages, and trigger cascading failures across interconnected European energy grids, as demonstrated by attacks on Ukrainian power infrastructure in 2015 and 2016.

* Regulatory and legal exposure: The EU NIS2 Directive (effective October 2024) extends mandatory cybersecurity obligations to a significantly broader range of operators in energy, transport, water, and digital infrastructure. Non-compliance carries fines of up to 10 million euros or 2% of global annual turnover.

* Supply chain vulnerability: Third-party OT vendors and remote access pathways have become primary attack vectors; the 2021 Oldsmar water treatment breach in Florida, though US-based, illustrated the risk inherent in remote management tools widely used by European utilities.

* Reputational and investor consequences: Attacks on critical services attract intense media and political scrutiny; executives responsible for inadequate cyber governance face personal liability under NIS2 and emerging EU cyber resilience frameworks.

* Decision window is narrowing: Geopolitical pressure on European infrastructure is accelerating; the Russian invasion of Ukraine has directly correlated with a documented increase in attacks on EU member state energy systems.

Authoritative Analysis: Who Is Attacking, and How

The threat actor landscape is more complex than the popular “Russian hacker” narrative suggests. European security agencies have identified at least four distinct categories of adversary, each with different objectives and methods.

ENISA, the EU Agency for Cybersecurity, in its Threat Landscape 2024 report published in October 2024, identified energy as the second most targeted sector in the EU, accounting for 11.3% of all significant cyber incidents. The agency specifically highlighted the growing use of “living off the land” techniques, where attackers exploit legitimate tools already present within OT environments to avoid detection, making attribution and response significantly harder.

Sandworm, a unit of Russian military intelligence (GRU), represents the most capable and aggressive threat to European energy infrastructure. Its 2022 Industroyer2 malware, designed specifically to disrupt industrial control systems operating power substations, was deployed against Ukrainian energy facilities and has been assessed by analysts at ESET and Mandiant as a direct template for future European operations. Sandworm was also responsible for the 2022 Viasat satellite attack that disrupted communications across EU member states, confirming its willingness to conduct operations beyond Ukrainian borders.

In May 2023, Denmark experienced its most significant cyberattack on critical infrastructure to date. SektorCERT, the Danish energy sector cybersecurity organisation, reported in its November 2023 public analysis that 22 energy companies were targeted simultaneously in a two-wave operation. The first wave exploited a zero-day vulnerability in Zyxel firewalls; the second deployed more sophisticated techniques consistent with Sandworm tradecraft. Eleven companies were directly compromised.

Volt Typhoon, a Chinese state-sponsored group first publicly identified by Microsoft in May 2023, has been assessed by the US Cybersecurity and Infrastructure Security Agency (CISA) and its Five Eyes partners as pre-positioning within critical infrastructure OT networks for potential future disruption; rather than conducting immediate destructive attacks, the group embeds itself and waits. European governments have been formally warned that Volt Typhoon activity has been detected beyond North American networks.

Criminal ransomware operations, while typically motivated by financial gain rather than geopolitical disruption, pose an equally serious threat to operational continuity. The 2021 Colonial Pipeline attack in the United States, which disrupted fuel supplies across the eastern seaboard, demonstrated that ransomware actors are willing to target critical infrastructure. In Europe, the 2022 attack on Deutsche Windtechnik, which manages approximately 2,000 wind turbines, resulted in the temporary disconnection of remote monitoring for thousands of installations.

Strategic Implications for Corporate Directors and Government Ministers

For Corporate Directors

The OT cybersecurity threat demands a fundamental reassessment of risk governance structures. In most European industrial organisations, OT security has historically sat outside the CISO’s remit, managed instead by engineering or operations teams with limited cybersecurity expertise. That division is no longer tenable.

The immediate priority is network segmentation: ensuring that IT and OT networks are not just notionally separate but architecturally isolated, with monitored and authenticated connection points for any legitimate data exchange. This is not a technical recommendation alone; it requires board-level commitment to capital expenditure and operational restructuring.

Asset visibility is a prerequisite for protection. Many European industrial operators cannot accurately inventory all devices on their OT networks, particularly legacy programmable logic controllers (PLCs) installed before cybersecurity was a design consideration. Threat actors exploit exactly this invisibility. A comprehensive OT asset management programme, using dedicated industrial discovery tools rather than IT-focused solutions that can disrupt fragile OT protocols, must be in place before defensive technologies can function effectively.

Supplier and third-party risk management has become non-negotiable. NIS2 explicitly extends obligations upstream to supply chains; corporate directors should ensure contractual cybersecurity requirements are embedded in all OT vendor and service provider agreements, backed by audit rights.

For Government Ministers

The Danish SektorCERT model, a sector-specific threat intelligence sharing and incident coordination centre for the energy industry, deserves examination as a template for wider European adoption. The speed and coordination of the response to the May 2023 attacks, which prevented what could have been a significantly more damaging incident, was directly attributable to real-time information sharing across operators.

Gibraltar’s position as a British Overseas Territory with close regulatory alignment to EU standards, particularly in financial services, presents a specific policy consideration. Gibraltar-headquartered energy and utility operators remain subject to UK cybersecurity frameworks post-Brexit; however, given the territory’s deep economic integration with Spain and broader European markets, voluntary alignment with NIS2 standards would reduce cross-border regulatory friction and demonstrate leadership in cyber governance.

Cross-border coordination through ENISA’s structured information sharing platforms and the nascent EU CyCLONe (Cyber Crisis Liaison Organisation Network) requires acceleration. Current incident notification timelines under NIS2 (24 hours for early warning, 72 hours for incident notification) are operationally demanding for organisations without mature response capabilities; ministers should invest in pre-positioned response teams and exercises.