Tomislav Vazdar direktor je tvrtke Riskoria,
Zagreb koja se bavi kibernetičkom sigurnošću i upravljanjem digitalnim rizicima.
Za upite: info@riskoria.eu.

1.1.Energetska sigurnost sve manje ovisi o tome ima li goriva, a sve više o tome tko i što upravlja upravljačkim sustavima

Dvadeset osmog travnja 2025. godine Iberijski poluotok ostao je bez struje, a gotovo svi su pomislili isto: napad. Osam mjeseci kasnije, 29. prosinca 2025. godine, poljska elektroenergetska mreža doista je doživjela koordinirani kibernetici napad na sustave koji upravljaju postrojenjima, i to na više lokacija istodobno, a jedva je itko primijetio. Reagiramo emotivno kad se ugase svjetla, a analitički gotovo nikad. Ozbiljne se stvari, međutim, događaju upravo dok su upaljena.

2.Prvo pitanje je gotovo uvijek pogrešno

Španjolska vlada predstavila je izvješće o uzrocima zamračenja 17. lipnja 2025. godine. Provedena je, kako je navedeno, najopsežnija provjera kibernetičke sigurnosti ikad napravljena u toj zemlji, u kojoj je sudjelovalo više od 75 ljudi u šest timova, na tri razine analize. Nije pronađen nijedan dokaz da je uzrok bio kibernetički napad. Konačno izvješće stručnog povjerenstva europske mreže operatora prijenosnih sustava, objavljeno 20. ožujka 2026. godine, potvrdilo je tehničku sliku: oscilacije u sustavu, propusti u regulaciji napona i jalove snage te lančana isključenja proizvodnih jedinica. Mreža je, jednostavno rečeno, pala sama od sebe.

Vrijedi ipak pročitati i drugu rečenicu istog izvješća, koju su mediji gotovo prešutjeli. Iako napad nije bio uzrok, povjerenstvo je utvrdilo ranjivosti, propuste i pogrešne konfiguracije sigurnosnih mjera koje bi sustave mogle izložiti budućim rizicima. Prva pretpostavka bila je pogrešna. Razlog zbog kojeg se činila uvjerljivom nije nestao.

3.Napadi koji ne izgledaju kao napadi
Kibernetički napad na energetiku gotovo nikad ne izgleda kao ono što ljudi zamišljaju. Nema eksplozije ni provale. Napadač uđe kroz uređaj koji je ostao dostupan s interneta, a zatim opremi šalje naredbe koje ta oprema smatra posve legitimnima.

U noći s 22. na 23. siječnja 2024. godine više od 600 stambenih zgrada u Lavovu ostalo je bez grijanja gotovo dva dana, u temperaturama ispod nule. Nije pao projektil. Rad općinske toplane zaustavljen je s tipkovnice. Prema analizi tvrtke Dragos, napadači su ušli preko industrijskih uređaja izloženih internetu, a zlonamjerni alat nazvan FrostyGoop slao je naredbe protokolom Modbus, starijim od četiri desetljeća. Firmver na regulatorima prethodno je vraćen na inačicu bez mogućnosti nadzora, pa operateri više nisu vidjeli što se događa. Napad nije bio spektakularan. Bio je tih i osmišljen tako da obrana oslijepi.

Poljski slučaj pokazuje promjenu mete. I ondje se radilo o kibernetičkom napadu, a ne o sabotaži na terenu. Napadači nisu prišli nijednom postrojenju nego su preko mrežne opreme preuzeli udaljene terminalne jedinice, uređaje koji upravljaju radom pojedine elektrane i šalju podatke upravljačkom centru. Meta nisu bili veliki prijenosni objekti nego distribuirani izvori: vjetroelektrane, sunčane elektrane i kogeneracijsko postrojenje. Prema Dragosu riječ je o prvom velikom koordiniranom napadu te vrste igdje u svijetu. Razlog je strukturni. Tranzicija zamjenjuje nekoliko desetaka velikih i dobro čuvanih elektrana s tisućama malih postrojenja, gotovo istovjetnih postavki i često ispod regulatornih pragova pisanih za veće objekte. Ono što energetsku tranziciju čini ekonomičnom, sigurnosno je čini težom.

4.Umjetna inteligencija ulazi s obje strane
Umjetna inteligencija u ovu priču ulazi na tri načina i nijedan nije bezazlen.

Prvi je potrošnja. Prema Međunarodnoj agenciji za energiju, potrošnja podatkovnih centara mogla bi do 2030. godine narasti na približno 945 TWh, dvostruko više nego danas. Energetika time dobiva potrošača koji raste brže od mreže koja ga napaja.

Drugi je upravljanje. Algoritmi se već koriste u predviđanju potražnje, uravnoteženju mreže, planiranju održavanja i otkrivanju kvarova. Prilog III. europske Uredbe o umjetnoj inteligenciji svrstava među visokorizične one sustave koji se koriste kao sigurnosne komponente u opskrbi vodom, plinom, grijanjem ili električnom energijom, a članak 14. traži djelotvoran ljudski nadzor uz svijest o automatizacijskoj pristranosti. To nije birokratski detalj. Operater koji mjesecima gleda točne prognoze počinje im vjerovati, a napad se u industrijskom okruženju ne prepoznaje po zlonamjernom kodu nego po uređaju koji radi nešto što smije, ali nema razloga raditi. Ta razlika traži prosudbu, a prosudba slabi ako je predugo nitko ne koristi.

Treći je sam napadač. U studenome 2025. godine Anthropic je objavio analizu špijunske kampanje u kojoj je model, uz minimalno ljudsko sudjelovanje, samostalno izveo 80 do 90 posto operacije protiv tridesetak organizacija. To ne uvodi novu vrstu napada na mrežu, nego skraćuje vrijeme između trenutka kad netko poželi napasti i trenutka kad to zna izvesti, a upravo je to vrijeme dosad bila glavna obrana malih operatora.

Energetska sigurnost danas nije pitanje hoće li netko ugasiti struju cijeloj zemlji. Rizik je postupniji i tiši. Sastoji se od napadača koji godinama sjede u sustavu i ne rade ništa, od uređaja kojima se nadzor onesposobi prije nego što se išta dogodi, od tisuća malih postrojenja koja nitko ne gleda i od organizacija koje su usklađene sa zakonom, a nisu otporne. Pravo se pitanje zato postavlja dok su svjetla upaljena i glasi drukčije nego što bismo očekivali. Ne pitamo može li netko napasti mrežu, jer može. Pitamo koliko bi nam trebalo da to uopće primijetimo, tko bi imao ovlast donijeti odluku o odspajanju i koliko dugo možemo raditi bez sustava kojima vjerujemo bez razmišljanja, uključujući i one koji sve češće odlučuju umjesto nas.

Izvori

Vlada Španjolske (17. lipnja 2025.). Izvješće o uzrocima zamračenja od 28. travnja 2025.: https://www.lamoncloa.gob.es/lang/en/gobierno/councilministers/paginas/2025/20250617-council-press-conference.aspx
ENTSO-E (20. ožujka 2026.). Expert Panel Final Report on 28 April 2025 Blackout in Spain and Portugal: https://www.entsoe.eu/news/2026/03/20/entso-e-publishes-expert-panel-final-report-on-28-april-2025-blackout-in-spain-and-portugal/
Dragos (2024). Intel Brief: Impact of FrostyGoop ICS Malware on Connected OT Systems: https://hub.dragos.com/report/frostygoop-ics-malware-impacting-operational-technology
Dragos (28. siječnja 2026.). Poland Power Grid Attack Targets Distributed Energy Facilities: https://www.dragos.com/blog/poland-power-grid-attack-electrum-targets-distributed-energy-2025
IEA (travanj 2025.). Energy and AI, sažetak: https://www.iea.org/reports/energy-and-ai/executive-summary
Uredba (EU) 2024/1689 o umjetnoj inteligenciji, Prilog III. i članak 14.: https://artificialintelligenceact.eu/annex/3/
Anthropic (studeni 2025.). Disrupting the first reported AI-orchestrated cyber espionage campaign: https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf
Zakon o kibernetičkoj sigurnosti, NN 14/2024: https://narodne-novine.nn.hr/clanci/sluzbeni/2024_02_14_254.html

Tomislav Vazdar is CEO of Riskoria,
Zagreb which works on cybersecurity and digital risk management.
Enquiries: info@riskoria.eu.

When the Lights Go Out, the First Question Is Usually the Wrong One

1.1.Energy security depends less and less on whether there is fuel, and more and more on who and what runs the control systems

On 28 April 2025 the Iberian Peninsula lost power, and almost everyone thought the same thing: an attack. Eight months later, on 29 December 2025, the Polish electricity grid did suffer a coordinated cyberattack on the systems that run its generating facilities, at several sites at once, and almost nobody noticed. We react emotionally when the lights go out, and analytically almost never. The serious things, however, happen while the lights are still on.

2.The First Question Is Almost Always the Wrong One

The Spanish government presented its report on the causes of the blackout on 17 June 2025. What was described as the largest cybersecurity investigation in the country’s history, involving more than 75 people across six teams and three levels of analysis, found no evidence of a cyberattack as the cause. The final report of the expert panel convened by the European network of transmission system operators, published on 20 March 2026, confirmed the technical picture: system oscillations, gaps in voltage and reactive power control, and cascading disconnections of generation units. The grid, put simply, fell over on its own.

It is worth reading the second sentence of that report, though, which the coverage largely passed over. While an attack was not the cause, the committee did identify vulnerabilities, gaps and misconfigured security measures that could expose systems to future risks. The first assumption was wrong. The reason it seemed plausible has not gone away.

3.Attacks That Do Not Look Like Attacks

A cyberattack on energy infrastructure almost never looks like what people imagine. There is no explosion and no break-in. The attacker enters through a device left reachable from the internet, then sends equipment commands that the equipment considers entirely legitimate.

Overnight from 22 to 23 January 2024, more than 600 apartment buildings in Lviv went without heat for almost two days in sub-zero temperatures. No missile landed. The municipal heating plant was stopped from a keyboard. According to analysis by Dragos, the attackers came in through industrial devices exposed to the internet, and malware named FrostyGoop issued commands over Modbus, a protocol older than four decades. The firmware on the controllers had first been rolled back to a version with no monitoring capability, so operators could no longer see what was happening. The attack was not spectacular. It was quiet, and built to blind the defence.

The Polish case shows a change of target. That too was a cyberattack rather than sabotage on the ground. The attackers went nowhere near a facility; they took over remote terminal units through network equipment, the devices that run an individual plant and relay its data to the control centre. What was hit was not large transmission assets but distributed resources: wind farms, solar installations and a combined heat and power plant. According to Dragos, this was the first major coordinated attack of its kind anywhere in the world. The reason is structural. The energy transition replaces a few dozen large, well-guarded plants with thousands of small facilities, configured to a common template and often sitting below regulatory thresholds written for bigger assets. What makes the transition economical makes it harder to defend.

4.Artificial Intelligence Enters from Both Sides

Artificial intelligence enters this story in three ways, and none of them is trivial.

The first is consumption. According to the International Energy Agency, data centre electricity use could reach roughly 945 TWh by 2030, double today’s level. The sector gains a consumer growing faster than the grid meant to supply it.

The second is control. Algorithms already sit in demand forecasting, grid balancing, maintenance planning and fault detection. Annex III of the European AI Act classifies as high-risk those systems used as safety components in the supply of water, gas, heating or electricity, and Article 14 requires effective human oversight with awareness of automation bias. That is not a bureaucratic detail. An operator who watches accurate forecasts for months begins to trust them, and an attack in an industrial environment is not recognised by malicious code but by a device doing something it is permitted to do while having no reason to do it. Telling those apart takes judgement, and judgement erodes when nobody exercises it.

The third is the attacker. In November 2025 Anthropic published an analysis of an espionage campaign in which a model, with minimal human involvement, autonomously executed 80 to 90 percent of the operation against some thirty organisations. That introduces no new class of attack on the grid; it shortens the time between someone wanting to attack and knowing how, and that time has until now been the main defence of small operators.

Energy security today is thus not a question of whether someone will switch off the power to an entire country. The risk is more gradual and quieter. It consists of attackers who sit inside systems for years doing nothing, of devices whose monitoring is disabled before anything happens, of thousands of small facilities nobody watches, and of organisations compliant with the law without being resilient. The real question is therefore asked while the lights are still on, and it sounds different from what we would expect. We do not ask whether someone can attack the grid, because they can. We ask how long it would take us to notice, who would have the authority to order a disconnection, and how long we could operate without the systems we trust without thinking, including the ones that increasingly decide on our behalf.

Sources

Government of Spain (17 June 2025). Report on the causes of the 28 April 2025 blackout: https://www.lamoncloa.gob.es/lang/en/gobierno/councilministers/paginas/2025/20250617-council-press-conference.aspx
ENTSO-E (20 March 2026). Expert Panel Final Report on 28 April 2025 Blackout in Spain and Portugal: https://www.entsoe.eu/news/2026/03/20/entso-e-publishes-expert-panel-final-report-on-28-april-2025-blackout-in-spain-and-portugal/
Dragos (2024). Intel Brief: Impact of FrostyGoop ICS Malware on Connected OT Systems: https://hub.dragos.com/report/frostygoop-ics-malware-impacting-operational-technology
Dragos (28 January 2026). Poland Power Grid Attack Targets Distributed Energy Facilities: https://www.dragos.com/blog/poland-power-grid-attack-electrum-targets-distributed-energy-2025
IEA (April 2025). Energy and AI, executive summary: https://www.iea.org/reports/energy-and-ai/executive-summary
Regulation (EU) 2024/1689 on Artificial Intelligence, Annex III and Article 14: https://artificialintelligenceact.eu/annex/3/
Anthropic (November 2025). Disrupting the first reported AI-orchestrated cyber espionage campaign: https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf
Cybersecurity Act (Zakon o kibernetičkoj sigurnosti), Official Gazette NN 14/2024: https://narodne-novine.nn.hr/clanci/sluzbeni/2024_02_14_254.html