Europe must learn to live with energy system sabotage risk: experts

Europe must learn to live with energy infrastructure attacks as the continent faces increasing physical and cyber sabotage threats from state actors and elsewhere, leading energy security experts said.

The range of potential threats is now too broad and dispersed to be entirely avoided, so system operators must adapt by building resilient infrastructure, Tatiana Mitrova, global fellow at Columbia University's Center on Global Energy Policy, told Platts, part of S&P Global Energy, in an interview.

The vulnerability of parts of Europe's energy system has been brought into stark relief in recent years, with a string of incidents involving power stations, gas platforms, cables, pipelines and airports.

The shadow of Europe's energy import dependency also hangs over the continent, still grappling with the fallout of its pivot away from Russian gas.

The perpetrators are not always state actors – an environmental activist claimed responsibility for recent attacks on German substations – but governments acknowledge the growing threat from Russia and elsewhere.

"We have to admit already that Europe is in a hybrid war," Mitrova said Sept. 4.

The German government said Russia was behind an explosive-laden drone discovered near Ukrainian cargo planes at a Leipzig airport, while Iranian hackers disrupted operations at a small-scale power generator in the UK earlier in the summer.

Platts has tracked nine cyberattacks on the commodity sector in the first eight months of 2026, with most affecting the oil industry. The power sector has borne the brunt of earlier attacks, with utilities and energy companies squarely in the crosshairs.

Mitrova said energy companies needed to catch up with Europe's military leaders in responding to the "tremendous asymmetry" whereby low-cost drones are making defense more costly and difficult, adding that the calculus for managing risk had changed.

"Now we have to accept that we cannot protect 100% anything, which means that the whole design of the system has to change," Mitrova said.

Tough lessons

Governments and companies must design systems to build resilience and redundancy. Power grids should be able to absorb the loss of a substation node, and infrastructure should have reserve facilities, Mitrova said.

"Resilience belongs to the network that delivers the service, not to any single asset," she said in a recent article for The National Interest. "The safest system is not one in which nothing can fail. It is one in which no single failure becomes fatal."

Countries can take lessons from Ukraine, which has learned the hard way.

"Ukraine these days has probably the best expertise in the world on how to keep an energy system operational despite massive attacks every day," she told Platts.

Countries in the Middle East are also tapping Ukrainian expertise, following Iranian attacks on energy infrastructure there, Ann Mettler, president of Catalyse Europe – a clean energy thinktank – said.

Mettler, a former Director General at the European Commission's European Political Strategy Centre, said the EU was still getting to grips with the new threats.

"The issue hasn't really arrived here in Brussels," she said in a Sept. 9 interview, noting that responsibility fell to EU member states.

Faced with hostile state actors, "democracies are at a structural disadvantage," Mettler said, adding, "There's no deterrence."

"No one's afraid of doing these attacks because we are very poor in attribution and holding anyone accountable," she said, though noted Germany's public claim of Russian involvement in the Leipzig airport incident was an important step.

Be prepared

In Ukraine, energy infrastructure operators have deployed autonomous 24/7 maintenance and repair teams capable of operating independently, Mitrova said.

"They need to make decisions in this autonomous mode, taking all the responsibility," she said. "This is something that big companies don't like."

While an extreme case, it is the kind of cultural shift needed for European energy system operators, she added.

Some system resilience comes down to procedures, protocols and training to counter cybersecurity threats or physical attacks, including extensions of existing measures, such as site monitoring and patrols, with increased use of digital tools and drones.

"From cyberattacks and sabotage to drone incursions and hybrid threats, Europe's power system must be prepared for a more complex landscape," the European Network of Transmission System Operators for Electricity said in a statement on Sept. 21, noting that transmission system operators were working together to strengthen power system resilience.

Cairn Risk Consulting said hackers could exploit safety features in solar farms such as off-the-shelf temperature sensors, unless they carried security-by-design features.

"The only way to effectively reconcile these competing needs is through a holistic design risk management process that thoroughly assesses the impacts of all design decisions on both safety and security," the company said.

Renewables could also boost resilience, being decentralized and modular by nature, Mitrova said. Facilities with solar generation and batteries capable of island mode operations would be particularly resilient.

Mettler said the EU should make the most of the 1.5% energy resilience allowance under the 5% NATO GDP target.

"That 1.5% ought to be used to make the energy system more sovereign, more secure and more resilient. And that means reducing dependencies on autocrats and reducing dependencies on fossil fuel imports."