Critical Infrastructure Under Siege: The Escalating OT and Energy Cybersecurity Threat Facing Europe in 2026

Europe’s operational technology (OT) infrastructure, the industrial control systems and networks that keep power grids live, pipelines pressurised, and water treatment plants functioning, is under sustained, sophisticated attack. This is no longer a theoretical risk confined to cybersecurity conference slides. Since 2022, documented incidents involving energy operators in Germany, Denmark, Finland, and the Baltic states have confirmed that state-aligned threat actors are targeting the physical systems that underpin economic stability and national security. For European corporate directors and government ministers, the strategic and legal implications are immediate.

Why This Matters: OT Cybersecurity Is Now a Board-Level Issue

Operational technology, meaning the hardware and software that monitors and controls physical industrial processes, was historically “air-gapped” from internet-connected IT systems. That separation no longer exists in most modern critical infrastructure, and the attack surface has expanded dramatically as a result.

Key dimensions of the threat for European leaders:

* Operational disruption risk: A successful OT cyberattack can physically damage equipment, cause extended outages, and trigger cascading failures across interconnected European energy grids, as demonstrated by attacks on Ukrainian power infrastructure in 2015 and 2016.

* Regulatory and legal exposure: The EU NIS2 Directive (effective October 2024) extends mandatory cybersecurity obligations to a significantly broader range of operators in energy, transport, water, and digital infrastructure. Non-compliance carries fines of up to 10 million euros or 2% of global annual turnover.

* Supply chain vulnerability: Third-party OT vendors and remote access pathways have become primary attack vectors; the 2021 Oldsmar water treatment breach in Florida, though US-based, illustrated the risk inherent in remote management tools widely used by European utilities.

* Reputational and investor consequences: Attacks on critical services attract intense media and political scrutiny; executives responsible for inadequate cyber governance face personal liability under NIS2 and emerging EU cyber resilience frameworks.

* Decision window is narrowing: Geopolitical pressure on European infrastructure is accelerating; the Russian invasion of Ukraine has directly correlated with a documented increase in attacks on EU member state energy systems.

Authoritative Analysis: Who Is Attacking, and How

The threat actor landscape is more complex than the popular “Russian hacker” narrative suggests. European security agencies have identified at least four distinct categories of adversary, each with different objectives and methods.

ENISA, the EU Agency for Cybersecurity, in its Threat Landscape 2024 report published in October 2024, identified energy as the second most targeted sector in the EU, accounting for 11.3% of all significant cyber incidents. The agency specifically highlighted the growing use of “living off the land” techniques, where attackers exploit legitimate tools already present within OT environments to avoid detection, making attribution and response significantly harder.

Sandworm, a unit of Russian military intelligence (GRU), represents the most capable and aggressive threat to European energy infrastructure. Its 2022 Industroyer2 malware, designed specifically to disrupt industrial control systems operating power substations, was deployed against Ukrainian energy facilities and has been assessed by analysts at ESET and Mandiant as a direct template for future European operations. Sandworm was also responsible for the 2022 Viasat satellite attack that disrupted communications across EU member states, confirming its willingness to conduct operations beyond Ukrainian borders.

In May 2023, Denmark experienced its most significant cyberattack on critical infrastructure to date. SektorCERT, the Danish energy sector cybersecurity organisation, reported in its November 2023 public analysis that 22 energy companies were targeted simultaneously in a two-wave operation. The first wave exploited a zero-day vulnerability in Zyxel firewalls; the second deployed more sophisticated techniques consistent with Sandworm tradecraft. Eleven companies were directly compromised.

Volt Typhoon, a Chinese state-sponsored group first publicly identified by Microsoft in May 2023, has been assessed by the US Cybersecurity and Infrastructure Security Agency (CISA) and its Five Eyes partners as pre-positioning within critical infrastructure OT networks for potential future disruption; rather than conducting immediate destructive attacks, the group embeds itself and waits. European governments have been formally warned that Volt Typhoon activity has been detected beyond North American networks.

Criminal ransomware operations, while typically motivated by financial gain rather than geopolitical disruption, pose an equally serious threat to operational continuity. The 2021 Colonial Pipeline attack in the United States, which disrupted fuel supplies across the eastern seaboard, demonstrated that ransomware actors are willing to target critical infrastructure. In Europe, the 2022 attack on Deutsche Windtechnik, which manages approximately 2,000 wind turbines, resulted in the temporary disconnection of remote monitoring for thousands of installations.

Strategic Implications for Corporate Directors and Government Ministers

For Corporate Directors

The OT cybersecurity threat demands a fundamental reassessment of risk governance structures. In most European industrial organisations, OT security has historically sat outside the CISO’s remit, managed instead by engineering or operations teams with limited cybersecurity expertise. That division is no longer tenable.

The immediate priority is network segmentation: ensuring that IT and OT networks are not just notionally separate but architecturally isolated, with monitored and authenticated connection points for any legitimate data exchange. This is not a technical recommendation alone; it requires board-level commitment to capital expenditure and operational restructuring.

Asset visibility is a prerequisite for protection. Many European industrial operators cannot accurately inventory all devices on their OT networks, particularly legacy programmable logic controllers (PLCs) installed before cybersecurity was a design consideration. Threat actors exploit exactly this invisibility. A comprehensive OT asset management programme, using dedicated industrial discovery tools rather than IT-focused solutions that can disrupt fragile OT protocols, must be in place before defensive technologies can function effectively.

Supplier and third-party risk management has become non-negotiable. NIS2 explicitly extends obligations upstream to supply chains; corporate directors should ensure contractual cybersecurity requirements are embedded in all OT vendor and service provider agreements, backed by audit rights.

For Government Ministers

The Danish SektorCERT model, a sector-specific threat intelligence sharing and incident coordination centre for the energy industry, deserves examination as a template for wider European adoption. The speed and coordination of the response to the May 2023 attacks, which prevented what could have been a significantly more damaging incident, was directly attributable to real-time information sharing across operators.

Gibraltar’s position as a British Overseas Territory with close regulatory alignment to EU standards, particularly in financial services, presents a specific policy consideration. Gibraltar-headquartered energy and utility operators remain subject to UK cybersecurity frameworks post-Brexit; however, given the territory’s deep economic integration with Spain and broader European markets, voluntary alignment with NIS2 standards would reduce cross-border regulatory friction and demonstrate leadership in cyber governance.

Cross-border coordination through ENISA’s structured information sharing platforms and the nascent EU CyCLONe (Cyber Crisis Liaison Organisation Network) requires acceleration. Current incident notification timelines under NIS2 (24 hours for early warning, 72 hours for incident notification) are operationally demanding for organisations without mature response capabilities; ministers should invest in pre-positioned response teams and exercises.

Actionable Next Steps: A Time Segmented Framework

Immediate actions (within 30 days):

* Commission an OT asset inventory audit: Engage a specialist OT cybersecurity firm to enumerate all devices on industrial networks, identify unpatched vulnerabilities, and map remote access pathways. Responsible party: CISO and Head of Operations, reporting to the Board Risk Committee.

* Review NIS2 compliance status: Legal and security teams should produce a gap analysis against NIS2 obligations, with particular attention to incident reporting obligations and supply chain requirements. Responsible party: General Counsel and CISO.

Short-term actions (within 90 days):

* Implement network segmentation and monitoring: Deploy OT-specific intrusion detection systems (such as Claroty, Dragos, or Nozomi Networks solutions) at IT/OT boundaries; establish continuous monitoring with alerting escalated to a 24/7 security operations function. Responsible party: IT and OT engineering leadership.

* Conduct tabletop incident response exercise: Simulate a ransomware or destructive attack scenario targeting OT systems, involving IT security, operations, legal, communications, and senior leadership. Identify gaps in response capability and governance. Responsible party: CISO with external facilitation recommended.

* Establish threat intelligence subscriptions: Join sector-specific information sharing bodies such as E-ISAC (Electricity Information Sharing and Analysis Centre) and engage with national CERT teams; formalise a process for operationalising incoming threat intelligence into defensive actions. Responsible party: Security operations team.

Strategic actions (six to twelve months):

* Develop and test an OT cyber resilience programme: This should encompass patch management processes adapted for operational constraints, a supplier cybersecurity assurance programme, and a defined recovery time objective for critical OT systems following a destructive attack. Responsible party: Board-sponsored programme with joint IT/OT leadership.

* Engage proactively with national and EU regulatory bodies: Seek pre-submission meetings with competent authorities on NIS2 compliance; participate in ENISA consultation processes; where relevant, engage with UK NCSC and DSIT on alignment between UK and EU frameworks for cross-border operators. Responsible party: Government Affairs and Compliance functions.

Forward Insights: What Comes Next in OT Cybersecurity

The convergence of two trends will define the threat environment through 2026 and beyond. First, the accelerating deployment of smart grid technology, renewable energy assets, and connected industrial sensors is dramatically expanding the OT attack surface; every new connected device is a potential entry point. Second, the geopolitical alignment between Russia, China, Iran, and North Korea in adversarial cyber operations, documented in increasingly detailed assessments from Western intelligence agencies, suggests that the pool of capable, motivated threat actors targeting European infrastructure will grow rather than diminish.

Artificial intelligence is beginning to alter both sides of the equation. Defenders are deploying AI-driven anomaly detection to identify subtle deviations in OT network behaviour that would evade rule-based systems. Attackers, meanwhile, are using AI to accelerate vulnerability research, improve phishing campaigns targeting OT engineers, and adapt malware to specific industrial control system configurations. The advantage is not inherently with either side; it will accrue to whichever organisations invest earliest and most strategically.

For European corporate leaders and government ministers, the central message is straightforward: OT cybersecurity is no longer a technical matter delegated to engineers. It is a strategic risk with direct financial, legal, reputational, and national security dimensions. The organisations and governments that treat it as such, and invest accordingly, will be significantly better positioned to withstand the attacks that are already underway.

Key Takeaways

 Nation-state actors including Russia’s Sandworm and China’s Volt Typhoon are actively targeting European OT and energy infrastructure; the Danish 2023 attack on 22 energy companies confirmed this is not a theoretical risk.

 The EU NIS2 Directive (effective October 2024) creates enforceable cybersecurity obligations for a broad range of critical infrastructure operators, with significant financial penalties and personal liability for executives.

 OT networks require fundamentally different security approaches to IT environments; legacy air-gap assumptions no longer apply, and most industrial operators face significant asset visibility gaps.

 Sector-specific threat intelligence sharing, as demonstrated by Denmark’s SektorCERT model, has proven materially effective in reducing attack impact; European governments should accelerate similar structures.

 AI-driven attacks are beginning to emerge; organisations that establish strong OT security foundations now will be better positioned to adapt as adversary capabilities evolve.