Dutch Inspectorate Warns of Cybersecurity Risks for Cloud Home Batteries

The Dutch Digital Infrastructure Inspectorate, Rijksinspectie Digitale Infrastructuur, discussed in its recently published position the cybersecurity risks associated with platforms managing home batteries, inverters, and electric vehicle chargers. The document emphasizes that a failure in updating or a cyberattack on production and aggregator platforms could simultaneously disable enough inverters and other devices to destabilize the power grid. The inspectorate points out that the greatest risk does not come from individual devices, but from the backend systems of manufacturers and energy management system providers using shared cloud platforms. If a large group of devices is connected to one backend system, a single access point can control many devices simultaneously. To restore balance, it may be necessary to address a sudden imbalance of 3 gigawatts or more, as the inspectorate notes, citing a study by SolarPower Europe. From 2019 to 2024, the number of heat pumps and electric vehicle chargers in the Netherlands increased fivefold.

Among the ways in which a large number of devices can be affected simultaneously are: remote updating or changing settings by the manufacturer, exploiting vulnerabilities in devices or their control platforms, or state intervention in the operations of manufacturers and service providers under its jurisdiction. According to the European Cyber Resilience Act, such devices face only general cybersecurity requirements, and compliance is enforced by the manufacturers themselves. The requirements apply only to products that will be released on the EU market from December 11, 2027. The NIS2 provisions apply mainly based on company size, so smaller companies are not covered unless designated by national authorities. This also applies to energy companies and manufacturers without jurisdiction in the EU. The interim list of entities whose obligations come into effect in mid-2028 does not include manufacturers or suppliers of energy management systems. The inspectorate proposed three solutions, including developing harmonized EU standards for specific devices and adding categories of these devices to the list of critical products class II of the Cyber Resilience Act. This would require independent assessment before sale in the European Union. It is also proposed to bring companies that can remotely control sufficient power to threaten grid stability under the NIS2, regardless of their size or location, and to enhance the digital autonomy of the grid by limiting reliance on companies outside the EU that can influence devices on a large scale.

Isabelle van der Ley, the inspectorate's manager for digital resilience in the energy sector, noted that devices make the electrical system smarter and more resilient, but at the same time create new risks that require both secure devices and the resilience of the entire energy system. Additionally, the European Commission's expert group this month recommended classifying solar inverters as critical products class II under the Cyber Resilience Act, noting that the analysis does not cover electric vehicle chargers, heat pumps, or battery storage systems, which may be assessed later. At the cybersecurity forum in Brussels on October 8, researchers from the European Network for Cyber Security demonstrated how a compromised smart home device could be used to send commands to a home inverter or battery on the same network. "More powerful IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and can be exploited again to disrupt the power grid," said Harm van den Brink, a cybersecurity researcher at ENCS. He added, "In the short term, we need independent security testing prioritized based on the amount of power potentially affected with vulnerability management by manufacturers." The inspectorate presented its document at the ONE Conference in The Hague, where researchers from Modat and the Dutch National Cyber Security Center also reported on 8,547 systems accessible via the internet in European solar and wind installations that should not be online.