A cyberattack scenario on grid-scale battery storage could be mistaken for normal controller behavior or frequency-response actions, making detection difficult until widespread outages occur.

The attack could mimic standard frequency-response patterns, masking malicious activity in real time as batteries respond to grid conditions.

Centrii’s analysis estimates that compromised units would cluster regionally, about 1,500 in Texas (ERCOT) and around 400 in Great Britain, with the potential for severe damages and outages.

The study illustrates how relatively small fractions of total storage fleets, in terms of installed capacity and unit counts, can trigger disproportionate impacts.

Forensics would need logs from OEMs and platform providers, not just system operators, to determine attacker intent and trace command provenance.

Britain’s grid has a secured-loss ceiling around 1.8 GW; exceeding this threshold could trigger automatic demand shedding and cause widespread damage regardless of attacker intent.

Spain’s 2025 outage investigation highlights data gaps and attribution challenges, as oscillations can result from both faults and deliberate actions, complicating post-event analysis.

The report frames the threat as a deliberate compromise of grid storage control, underscoring the need for robust cyber defense and anomaly detection in energy storage systems.

The core vulnerability lies in control planes and cloud-based optimizers that dispatch batteries; a compromised login could enable rapid, widespread dispatch across sites owned by different firms.

In Britain, roughly 400 storage units (about 29% of the fleet) could trigger a national blackout, potentially affecting 67 million people and costing up to £2–£10 billion.

A successful attack might be detected by timing and phase of power injections—the so‑called “reverse governor” where injections destabilize rather than oppose the disturbance.

Different studies show varying unit-count implications, creating uncertainty about how many units must be compromised for a significant impact.