Chile solar and battery system remain offline after cyberattack

Chile’s 103 MW Huatacondo solar park and its 98 MW/312 MWh battery energy storage system (BESS) have remained disconnected for two months following an incident that the National Electric Coordinator (Coordinador Eléctrico Nacional) recorded as a cyberattack.

The coordinator’s daily report for Oct. 27 continues to list both installations under forced outages, with 0% availability. The reported cause remains the one recorded on Aug. 27 under forced-disconnection request SDCF 2026100475.

The incident was recorded at 1:10 p.m. on Aug. 27, when control center RNE submitted a forced-disconnection request for the solar park and its battery system. The stated cause was a “cyberattack on Huatacondo facilities,” which disconnected both installations from Chile’s National Electric System (SEN). At the same time, RNE requested the forced disconnection of the 220/23 kV TR1 transformer at Santa Rita substation, also “due to cyberattack,” under request SDCF 2026100746.

The same daily report records two further incidents attributed to cyberattacks. At 9:30 p.m., control center Espinos (Potencia) reported that the Olivos and Espinos thermal power plants in Los Vilos, in the Coquimbo region, were unavailable for dispatch following the loss of supervisory control and remote operation of their facilities “due to a cyberattack.” The document does not establish whether these incidents were related to the Huatacondo event reported earlier that day or whether they resulted from a single coordinated action.

Inaugurated in 2019, the Huatacondo solar park belongs to a consortium comprising Japan’s Sojitz Corporation, with a 60% stake; Shikoku Electric Power, with 30%; and France’s Eiffage, with 10%.

The battery project was developed by AustrianSolar Chile Cuatro SpA and began construction in 2025. Canadian Solar subsidiary e-STORAGE was awarded the battery supply contract, while Tritec-Intervento undertook the balance-of-plant work. The BESS was still undergoing commissioning when the incident occurred, and the coordinator’s Oct. 27 report continued to list it in that status. Its unavailability therefore does not represent two months of disruption to an established commercial operation.

A review of the coordinator’s daily reports covering Oct. 28, 2025, to Oct. 27, 2026, examined 360 of the 365 documents in the period. No other new incidents explicitly attributed to “cyberattacks” or “cyberattacks” in the Spanish-language terminology were identified in the reports reviewed, apart from those notified on Aug. 27. Later references concerned the continued disconnection of Huatacondo.

Five reports could not be checked: those dated Oct. 29 and Oct. 31, 2025, and March 30, Aug. 31 and Sept. 8, 2026. The review therefore cannot establish that the Aug. 27 incident was the only or the first of its kind during the period. It does, however, indicate that incidents explicitly described using those terms were uncommon in the operational reports examined.

In October 2025, Patricio Leyton, director of the coordinator’s Cybersecurity and Critical Infrastructure Unit, told Reporte Minero that Chile had not recorded attacks with a significant impact on its electricity infrastructure up to that point, although the organization detected millions of attempts each day.

The coordinator has a cybersecurity incident notification protocol that sets reporting obligations for companies operating within the coordinated electricity system. On Aug. 28, one day after the reported incidents, Chile’s National Energy Commission (CNE) opened a public consultation on a proposed Technical Standard for Cybersecurity and Information Security for the electricity sector. The process to develop the standard had begun in 2021.

pv magazine has requested information from the National Electric Coordinator and AustrianSolar Chile Cuatro SpA about the circumstances of the attack, its operational consequences and the expected recovery timeline. Neither organization had responded by publication.

No public statement has been located that establishes the origin of the incident, which IT systems were affected, whether the events reported on Aug. 27 were connected, or why Huatacondo has remained unavailable for so long. The coordinator’s reports record causes communicated by operators but do not, in themselves, constitute a technical investigation capable of establishing the nature and scope of the attacks.

From pv magazine LatAm