Critical infrastructure is under attack in almost every country, but especially in the United Kingdom. The UK was the most attacked country in Europe, which is already the region most impacted by cyber incidents. The energy industry is taking the brunt of those cyberattacks, according to IBM’s X-Force Threat Intelligence Index 2024.

The energy sector is a favorite target for threat actors. The complexity of systems and the reliance on legacy OT systems make them easy prey. Because of the critical nature of these systems, threat actors know that ransoms will be paid to keep downtime to a minimum.

A changing threat landscape

Ransomware is the top threat to the UK’s critical infrastructure, according to the National Cyber Security Centre (NCSC). While some companies are hit with malware attacks directly, there is increasing risk to the OT supply chain, as suppliers and smaller companies that support energy and utilities are more likely to be victims of a cyberattack. These suppliers often lack good cybersecurity programs, making them an easy target for infiltrating larger critical infrastructure organizations.

The war in Ukraine has elevated the risk to the UK’s energy industry. The conflict has emboldened state-related threat actors, and the NCSC warned that the most significant threat to the critical infrastructure is malware launched by nation-state groups. The goal of these threat actors is disruption of operation, which can have a severe impact on the populations that critical infrastructure serves.

Read the Threat Intelligence Index report

Why the UK is Europe’s top target

The UK is the headquarters of several of the world’s biggest energy companies and is considered a major operations point for many more. These companies include:

  • British Petroleum (BP)
  • Royal Dutch Shell
  • Chevron
  • TotalEnergies
  • NationalGrid
  • Drax Group
  • Energy One.

An attack on any of these companies could have a national or global impact. For example, when Australian company Energy One was hit with a cyberattack last year, it also impacted systems across the UK. NationalGrid has reported several near misses — cyberattacks that could have done serious damage to the electric grid, but either cyber criminals missed their mark or the cybersecurity systems did their job to keep the lights on in the UK.

However, threat actors are busy. UK intelligence agencies have discovered active forums and dark web sites sharing information on how to access organizations across the energy and utilities industry. While some are looking at how to get into corporate systems, a growing number of cyber criminals are more interested in accessing the OT systems of the energy sector.

How OT impacts cybersecurity

OT presents a different cybersecurity challenge from IT systems. Traditionally, most OT systems across the energy industry were stand-alone, unconnected from the internet and other systems. However, as infrastructure grows more complex, vulnerabilities are increasing and adding new threat layers —  particularly in the software supply chain. Adding to the problem are the legacy systems in OT, with firmware that can’t be updated or hardware that can’t be replaced without reducing efficiency.

As a result, this sets up a catch-22 for the energy industry: How do you continue to use legacy systems while cybersecurity threats against the energy sector are on the rise?

It starts with knowing your exposure, according to the IBM report. Implementing zero trust and least privilege frameworks will limit access and misuse of credentials. But chances are there are credentials already available on the dark web, so it is necessary to use dark web capabilities to find credentials at risk, identify leaked identities and check social media networks sharing unauthorized information.

Most importantly, the energy industry needs to prioritize cybersecurity across critical systems. Threat actors will continue to take advantage of weak OT systems and an uncertain global outlook, especially as war rages in Europe. Nation-state actors want to take down the critical infrastructure in the countries they see as enemies, and as the UK is home to many of the world’s largest and most important energy companies, it will remain at high risk.

More from Risk Management

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Addressing growing concerns about cybersecurity in manufacturing

4 min read - Manufacturing has become increasingly reliant on modern technology, including industrial control systems (ICS), Internet of Things (IoT) devices and operational technology (OT). While these innovations boost productivity and streamline operations, they’ve vastly expanded the cyberattack surface.According to the 2024 IBM Cost of a Data Breach report, the average total cost of a data breach in the industrial sector was $5.56 million. This reflects an 18% increase for the sector compared to 2023.Apparently, the data being stored in industrial control systems is…

Cybersecurity Awareness Month: Horror stories

4 min read - When it comes to cybersecurity, the question is when, not if, an organization will suffer a cyber incident. Even the most sophisticated security tools can’t withstand the biggest threat: human behavior.October is Cybersecurity Awareness Month, the time of year when we celebrate all things scary. So it seemed appropriate to ask cybersecurity professionals to share some of their most memorable and haunting cyber incidents. (Names and companies are anonymous to avoid any negative impact. Suffering a cyber incident is bad…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today