Disturbing news emerged from Poland in the final week of December 2025. A cyberattack on Polish energy and heat transmission systems very nearly caused a nationwide blackout but was repelled without any disruption to the system thanks to the tireless work of Polish first-response teams. It was later linked to Russia. Of course, the Russians have been harassing their European neighbours since even before their 2022 invasion of Ukraine, through drones, jets and severed subsea internet cables, and they show no sign of stopping any time soon. This latest attack was another chapter in their heated hybrid warfare campaign, aimed at testing and prodding the responses of the targeted countries without meeting the threshold for a triggering of Article 5, but this one was notably different. Rather than attacking bigger transmission plants as they have done in the past, this one targeted smaller renewable installations, down to individual solar farms and wind turbines.
Essentially, the attackers targeted ICS/SCADA, and the data links operators use for grid balancing, effectively trying to “blind” the control centre to roughly a quarter of national generation coming from renewables. The malware was meant to wipe data and cause lasting damage, perhaps in part as a punishment for Poland’s strong support of Ukraine, and perhaps partially to influence a return to oil as a matter of national security. They deliberately targeted the grid during peak demand, when the country was likely to be low on staff and relied on the cold winter as a punitive factor. This playbook could very well be used with terrifying efficiency in Nordic countries, who are far more reliant on renewable energy than Poland.
Why This Matters for the Nordics
The Nordics have some of the most digitized systems for energy transmission in the world, with a high penetration of smart meters, automated balancing and cross-border exchanges. While this has the benefit of making the Nordic systems highly efficient, it has also left a vulnerable gap. Even small, local operations targeted at individual producers, like in Poland, can have far-reaching consequences if the malware is allowed to spread. Over the past decade, the Nordics have moved towards exactly the kind of renewable-heavy, sensor-rich distribution networks that Poland saw attacked. Poland managed to stave off the attack, but that is no guarantee that the Nordics will be able to do the same – and remember, had the attack succeeded, it would have left lasting damage. Furthermore, the Baltic Sea is already a hotbed for covert Russian sabotage work, where many wind turbines are placed which would likely make Finland, Sweden and Denmark attractive targets. However, the Nordics are highly interconnected and a successful attack on one will most likely spill over to their Nordic neighbours as well. Iceland and Greenland may be safer in this regard, but an attack of this kind on any Scandinavian country will likely impact them all.
Policy Going Forward
This isn’t to say that the push towards renewable energy is a vulnerability in and of itself, but rather that relying on new technologies brings unique exposures that countries must learn to shield against. In fact, moving away from oil and gas may be even more important in terms of national security, as that is Russia’s main export. Centralised heating and energy systems are sitting ducks, easily taken out via well-planned sabotage, but as that has been the case for the last hundred years, any measures taken to hedge against that possibility happen without notice. Renewables are newer technologies, with new advantages and disadvantages – and countries are learning how to navigate them in real time. The name of the game is diversification and intrastate resilience, which is likely the direction regulations will head.
To begin with, the bar for both vendors and renewable energy systems will likely be raised through varying certification schemes. The Nordics, or the EU, must work together to set these standards fairly, hopefully with minimal impact on the already slow processes of today. Furthermore, the Nordics should, like Poland, assign a cybersecurity group to 24/7 monitoring of the grid system working in tight connection with first-response teams, energy suppliers and grid operators. An interesting idea could also be to do joint exercises across the Nordic and Baltic regions in order to test resilience and potentially plug gaps, which could potentially be done under the NATO flag or simply as a cross-region exercise.
Iceland and Greenland may be safer in this regard, but largely by virtue of isolation rather than superior defences, a protection that could erode quickly as interconnectors, data links, and remote operations expand northward. The lesson from Poland is therefore not merely about Russian intent, which is already well understood, but about timing: Europe’s energy transition is racing ahead of its security architecture. If renewables are to form the backbone of Nordic energy security, then the cybersecurity necessary to protect them must be treated as core infrastructure rather than an auxiliary concern. That means accepting higher upfront costs, slower rollouts, and a far more militarized approach to grid protection than has been politically comfortable so far. Hybrid warfare thrives in the gaps between civilian efficiency and strategic preparedness, and unless those gaps are closed quickly, the Nordics may find that their greatest strengths can just as easily become a weakness.