Cyberattack on BESS fleets ‘probable’ by 2031, modeling warns

A new study by risk assessment firm Centrii paints a sobering picture for the operational technology securing global energy storage fleets. 

In the study, 10,000 Monte Carlo simulations were run across multiple industry security postures, with the group calculating a 92% probability of a major coordinated cyberattack on battery energy storage system (BESS) infrastructure by 2031 under current operational baseline standards.

The mechanism explored multiple points of entry, with a model of a “Gridlock” scenario, which is defined as “a coordinated cyber-physical attack in which adversaries compromise multiple BESS units and orchestrate synchronized charge/discharge cycles to destabilize the grid frequency.” 

Where sufficiently sized, megawatts of power swings within an instant could deviate grid frequency outside operational parameters, tripping safety relays, driving grid islanding, and inducing blackouts.

Centrii’s geographic modeling shows regional vulnerabilities. In Texas and its effectively islanded grid, manipulating what the study says is just 5.4% of connected BESS assets, roughly 1,500 units on the ERCOT system, could disrupt power for up to 30 million people and trigger billions in economic fallout. 

In the UK, a more connected grid, 29% of its storage fleet (or around 400 assets) could trigger a national blackout. (Appropriately, grid-forming inverters and synthetic inertia are becoming essential requirements in ERCOT.)

The modeling demonstrates that risk can be mitigated, though some of the mitigations fall under the study funder’s own brands and services.

Still, under aggressive implementation of wider IEC 62443 standards and regular simulations of attacks, the five-year attack probability falls to 61%, while the earliest projected attack window pushes back from 2027 to 2029. Centrii notes that implementing IEC 62443 across 28 GW of ERCOT storage would require an estimated $800 million to $2.8 billion.

Rafael Narezzi, CEO and co-founder of Centrii, stated that operational technology defense remains under-discussed in boardrooms because its return on investment is effectively invisible until an attack is prevented