Energy Companies Face Smarter Cyber Attacks Powered by AI

Energy companies around the world are under growing threat from cyber attacks. Hackers linked to governments like Russia, Iran, and China are now using artificial intelligence, or AI, to make their attacks faster and harder to stop. Power grids, wind farms, and other energy systems have been connected to the internet in recent years, which makes them easier to run but also easier to attack. Experts say smaller energy companies are especially at risk because they often don't have enough money or workers to protect themselves.

Ukraine's energy system has been hit repeatedly by Russian hackers since the war with Russia began. Poland also faced attacks, including one in December that tried to cut off communication between renewable energy farms and power companies. In the United States, officials warned that unknown hackers tried to break into devices made by Siemens, which are used in power plants and factories. In the United Kingdom, hackers with ties to Iran reportedly shut down a small energy facility, and the British government quickly warned energy leaders to protect their systems.

Researchers at a British cybersecurity company called Bridewell found that a Russian-linked hacking group called RomCom likely used AI to trick workers at important UK energy companies. This type of trick is called 'social engineering,' and AI makes these tricks much more convincing because it can write messages that sound real and personal. Experts say this is one of the most dangerous ways hackers are currently using AI. It can fool even careful workers into clicking dangerous links or sharing private information.

AI is also helping hackers who don't have a lot of technical skills. A tool called a large language model, or LLM, can help a hacker plan and carry out an attack without needing to be an expert. Rob Denaburg of the American Public Power Association said AI lowers the resources, time, and expertise needed to attack energy systems. In other words, AI is making it easier for more people to become hackers.

Energy systems use special computer languages, called protocols, to communicate with each other. In the past, a hacker needed years of study to understand these languages. Now, AI can help attackers speak the protocol language without all that training, Denaburg said. This means hackers can target equipment like programmable logic controllers — the computers that run power plants — much more easily than before.

AI also helps hackers find weak spots in energy systems much faster. Kieran Bhardwaj of Bridewell said attackers use AI to search through huge amounts of data and find which targets are most vulnerable. Hackers can then plan a step-by-step attack called a 'Cyber Kill Chain,' which maps out each weakness to hit in order. This kind of organized, AI-powered attack is very hard for energy companies to stop.

Big energy companies have improved their cybersecurity because they know the danger is real. But smaller utilities — especially those in rural areas — are struggling to keep up. Leo Simonovich of Siemens Energy said that small U.S. utilities are 'the weakest link' in energy security. These smaller companies often can't afford to hire a full team of cybersecurity workers or keep their systems protected around the clock.

Older equipment is also a big problem for the energy industry. Bhardwaj said that companies with a lot of old machines have a harder time improving their cybersecurity because old equipment often can't be updated with new security software. Even some renewable energy sources, like small solar farms, can be risky because they often connect straight to the internet with very little protection. Experts say fixing this will take time and money that many companies don't have.

There are steps energy companies can take to defend themselves. Simonovich suggested that companies should list all their equipment, watch for signs of attack, and keep their software updated. Groups like the Cybersecurity and Infrastructure Security Agency, or CISA, and the American Public Power Association offer training and tools to help. Energy companies can even use AI themselves to find and fix weak spots before hackers do.

Still, staying safe is not easy. Testing fixes takes a long time because companies must make sure an update won't accidentally cause a power outage. As Denaburg put it, 'Defenders have to be right 100 percent of the time, and attackers only have to be right once.' That means energy companies must stay alert every single day, while hackers only need to find one opening to cause serious harm.