Security must keep pace with Europe’s offshore wind expansion
New analysis calls for a holistic approach to cyber and physical security as North Sea countries aim to reach 300 GW of offshore wind capacity by 2050
BRUSSELS, 8 September 2026 – Europe must ensure that cyber, physical and supply-chain security keeps pace with offshore wind expansion, according to a new report from the European Initiative for Energy Security (EIES).
The expansion of offshore wind is transforming the North and Baltic Seas into a strategic energy backbone for Germany and Europe, critical to industrial competitiveness and energy security. Yet, with growing evidence of cyber, hybrid and physical attacks, security and resilience measures have not kept pace with the sector’s growing importance. As Germany and the North Sea countries prepare to build 300 GW of offshore-wind capacity by 2050, ensuring security keeps pace with deployment is a challenge for its energy security and industrial resilience.
Germany is a critical test case for protecting the continent’s increasingly interconnected energy infrastructure, In the last week, two suspected sabotage incidents have been reported on the German electricity grid, with “premeditated vandalism” affecting a power substation near Cologne in the west of the country, and damage to powerlines in Brandenburg in the east. More widely, in December 2025, coordinated cyberattacks targeted more than 30 wind and solar facilities in Poland, alongside a combined heat and power plant supplying heat to half a million people.
Protecting Europe’s Critical Energy Infrastructure: The Cyber-Physical Security of Germany’s Offshore Wind calls for action to prevent vulnerabilities across the supply chain, improve data-sharing and situational awareness, and prepare and test response and recovery plans. This includes:Beijing has introduced a rewards system for reporting attempts to circumvent its mineral export controls through MOFCOM Announcement 26. Europe’s response: it is wiring its grids, military bases and data centres with battery systems it does not control, built and operated by the same strategic rival – and is spending public money to do so.
Using national and European industrial policies, including the proposed Industrial Accelerator Act, to expand European manufacturing capacity for critical components.
Applying existing legal tools systematically to exclude high-risk suppliers from offshore wind auctions.
Strengthening the resilience of offshore infrastructure and maintaining the equipment, spares and specialist capacity needed to respond to disruption.
Improving secure information-sharing between operators and public authorities, including across borders, to strengthen situational awareness.
Conducting regular exercises at national, EU and NATO levels to test crisis responses and recovery plans.
Rosa Melissa Gehrung, Policy Associate at EIES and author of the report, said: “Offshore wind is becoming a strategic backbone of our energy supply. That is why security cannot be treated as an afterthought. It must be embedded into planning, procurement and investment decisions from the outset.”
Offshore wind deployment is accelerating, with 2.1 GW of new offshore wind capacity installed in Europe in the first half of 2026, three times the amount for the same period in 2025. Germany alone plans to roughly triple its offshore wind capacity by the end of the decade, from approximately 10.8 GW in July 2026 to at least 30 GW by 2030.
However, offshore wind farms are highly connected cyber-physical systems. Turbines, substations, subsea cables, digital control systems, remote-access functions and supply chains create interconnected security vulnerabilities. Disruption at a small number of critical points could affect electricity generation, grid stability and power supplies to homes and businesses across Europe.
Offshore wind assets are often located far from shore or beyond territorial waters, complicating surveillance, protection and emergency response. In Germany, approximately 95 per cent of current offshore wind capacity is located outside territorial waters.
As recent events show, the risk is no longer hypothetical. In Germany alone, incidents reported by critical infrastructure operators have increased by 60 per cent since 2021, from 452 to 724 in 2025. Energy infrastructure accounted for 153 reported incidents in 2025. At least 11 cables in the Baltic Sea have been damaged since October 2023, demonstrating the physical exposure of Europe’s maritime infrastructure. Globally, cyberattacks on energy organisations have tripled since 2020, to over 1,500 per organisation per week (2024), according to the International Energy Agency.
Albéric Mongrenier, Executive Director at EIES, said:“Europe’s energy infrastructure is on the front line, exposed to cyberattacks, sabotage and geopolitical coercion. Germany’s offshore-wind expansion is a critical test case. It can become a pillar of European strength, but security must keep pace with deployment. A secure energy transition is not simply a climate or industrial goal. It is a strategic imperative for Europe’s security and prosperity.”
Germany and the EU have already taken important steps to address these risks, including the adoption of the revised Network Information Security (NIS2) Directive and the Critical Entities Resilience (CER) Directive and their transposition into German law. The 2026 Hamburg Declaration also commits North Sea governments to greater coordination, situational awareness, harmonisation, incident response and preparedness.
At European level, the Commission announced €5.8 million for the first Regional Cable Hubs in the Baltic and Mediterranean Seas in June, alongside a €40 million call to expand European submarine-cable repair capacity. NATO has also established its Maritime Centre for the Security of Critical Undersea Infrastructure.
These initiatives reflect growing recognition that prevention is not enough. Europe must also be able to monitor activity across borders, detect incidents quickly and restore damaged infrastructure.
This is not solely a challenge for the offshore wind sector. Similar cyber-physical vulnerabilities, supply-chain exposure and lack of gaps in crisis preparedness also affect electricity grids, interconnectors, solar generation, subsea data cables and other critical infrastructure.
EIES is calling for security by design to be embedded across Europe’s energy infrastructure as the continent expands renewable and low-carbon energy and reduces its dependence on imported fossil fuels.
Media Contact:
Philip Armstrong, Communications Director
parmstrong@secureenergy.org | +44 7860 149876 | London, UK