Cybercriminals Intensify Attacks on Western Europe's Critical Infrastructure

Executive Summary

In early 2026, cybercriminal groups have significantly intensified their operations against critical infrastructure in Western Europe. These attacks have targeted sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector, leading to substantial disruptions and posing high-level threats to national security.

Recent Incidents

• Power Grids: On January 3, 2026, an arson attack on the Berlin power grid resulted in power outages affecting over 40,000 households and 2,000 businesses in southwest Berlin. The attack involved setting fire to a cable bridge at the Lichterfelde Heating and Power Station, leading to the longest power outage in the city since 1945. The group "Vulkangruppe" claimed responsibility, though investigations are ongoing. (en.wikipedia.org)

• Water Systems: In February 2026, a coordinated sabotage of Italy's national railway infrastructure occurred, primarily targeting the critical rail corridor near the Bologna hub. While no injuries were reported, the attacks caused extensive delays and service cancellations for approximately 40,000 passengers across Northern and Central Italy. An anarchist group claimed responsibility via an online manifesto. (en.wikipedia.org)

• Healthcare: On January 13, 2026, the AZ Monica hospital in Antwerp, Belgium, experienced a significant cyberattack that led to the shutdown of servers across its campuses. This disruption resulted in the cancellation of at least 70 surgeries and the transfer of seven critical patients to other facilities. The exact nature of the attack remains under investigation. (en.wikipedia.org)

Attribution and Threat Actors

The attacks have been attributed to various cybercriminal groups, including state-affiliated actors and hacktivist collectives. Notably, the group "NoName057(16)" has been linked to multiple distributed denial-of-service (DDoS) attacks targeting European entities, including Swedish authorities and German institutions. Europol's Operation Eastwood led to the disruption of this group's infrastructure and personnel, resulting in arrests and the seizure of servers. (techradar.com)

Additionally, Russian state-sponsored hacking groups, such as "Sandworm," have been implicated in cyberattacks on critical infrastructure. In December 2025, a cyberattack on the Polish power grid targeted both IT and physical industrial devices, affecting renewable energy plants and a combined heat and power plant. The attack was attributed to "Berserk Bear," a group associated with Russian state interests. (en.wikipedia.org)

Tactics and Techniques

Cybercriminals have employed a range of tactics to infiltrate critical infrastructure systems:

• Ransomware Attacks: In Romania, a ransomware attack utilized Microsoft's BitLocker encryption tool, taking approximately 1,000 computers offline across 10 of the country's 11 regional water management offices. Despite the digital disruption, water services remained unaffected, with normal operations maintained through alternative communication methods. (tomshardware.com)

• Exploitation of Network Edge Devices: Russian state-sponsored hackers have targeted misconfigured network edge devices in Western critical infrastructure since 2021. By compromising enterprise routers, VPN gateways, and network management devices, they intercept user credentials and gain access to internal systems. (cybersecuritynews.com)

Implications and Recommendations

The escalation of cyberattacks on critical infrastructure in Western Europe underscores the need for enhanced cybersecurity measures. Organizations must prioritize the protection of ICS and SCADA systems, implement robust network security protocols, and conduct regular vulnerability assessments. Collaboration between public and private sectors is essential to develop comprehensive strategies to mitigate these evolving threats.

Conclusion

The current threat landscape indicates a high level of sophistication and persistence among cybercriminal groups targeting critical infrastructure in Western Europe. Continuous vigilance, proactive defense strategies, and international cooperation are imperative to safeguard essential services and maintain national security.

Highlights:

• Norwegian police say pro-Russian hackers were likely behind suspected sabotage at a dam, Published on Wednesday, August 13
• 1,000 computers taken offline in Romanian water management authority hack - ransomware takes Bitlocker-encrypted systems down, Published on Monday, December 22
• Europol says it disrupted a major pro-Russian DDoS crime gang, Published on Thursday, July 17