The Netherlands’ digital infrastructure inspectorate, the Rijksinspectie Digitale Infrastructuur, says a faulty update or cyberattack on manufacturer and aggregator platforms could switch enough inverters, home batteries, heat pumps and EV chargers at once to destabilize the grid. It argues in a recently published position paper that the EU Cyber Resilience Act and NIS2 directive only partly cover the companies behind those platforms.

The biggest risk sits not in individual devices but in the backend systems of manufacturers, energy management system providers and aggregators, and in the cloud platforms they use, according to the inspectorate. Because large groups of devices connect to the same backend, a single point of entry can control many of them.

A sudden imbalance between supply and demand of 3 GW or more can disrupt the grid, the regulator says, citing research by SolarPower Europe. It says the number of heat pumps and EV chargers in the Netherlands grew fivefold between 2019 and 2024.

...

A European Commission expert group recommended in a report this month that solar inverters be classified as important class II products under the CRA, alongside restrictions on high-risk suppliers. The group said its analysis did not cover EV chargers, heat pumps or battery storage systems, which it could assess later.

At a cybersecurity forum in Brussels on Oct. 8, researchers from the European Network for Cyber Security (ENCS) showed how a compromised smart-home device could be used to send commands to a residential inverter or home battery on the same network.

“More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid,” said Harm van den Brink, a security researcher at ENCS. “In the short term, we need independent security testing, prioritized according to the amount of power potentially affected, combined with vulnerability management by manufacturers.”

The inspectorate presented its paper at the ONE Conference in The Hague, where researchers from Modat and the Dutch National Cyber Security Centre also reported 8,547 internet-facing systems at European solar and wind sites that should not be reachable online.

...

Archived