In the early hours of any given Tuesday, a water treatment plant operator in a mid-sized European city notices something odd on his screen: chlorine levels rising and falling without control. It is not a technical glitch. It is an intruder who has crossed all digital barriers and is now playing with the systems that supply drinking water to thousands of people. Scenes like this, which a decade ago seemed like movie scripts, have become one of the most urgent risks of the 21st century: cyberattacks on critical infrastructure.
Attacks on critical infrastructure have multiplied fourfold in the last three years, according to reports from security agencies in several countries.
From Extortion to Hybrid Warfare
What started as extortion crimes against private companies, with ransomware locking systems for ransom, has evolved into something more sophisticated and dangerous. Attacks no longer seek only money: they seek to destabilize. Power grids, transportation systems, hospitals, and chemical plants are sensitive targets because their failure has a direct impact on people's lives. When a cyberattack paralyzes a region's electricity supply, it is not an IT problem: it is a budding humanitarian crisis.
Experts point out that the line between cybercrime and cyberwar has blurred. Criminal groups operate with methods reminiscent of state intelligence services, and some governments have been accused of sponsoring attacks on rival countries' infrastructure. The difficulty of attributing an attack with certainty, coupled with plausible deniability, turns each incident into a diplomatic puzzle.
State Response: More Than Patches
Faced with this threat, governments have moved from reaction to prevention. Specialized agencies for critical infrastructure protection have been created, cybersecurity laws have been tightened, and coordination protocols between the public and private sectors have been established. In the European Union, for instance, the directive on the resilience of critical entities obliges member states to identify and protect essential sectors, from energy to banking. The United States, for its part, has issued rules requiring utility companies to report cyber incidents within very short deadlines.
But state response is not limited to defense. Increasingly, governments rehearse active response scenarios, including retaliatory cyberattacks. This opens a complex debate about the rules of the game in cyberspace. What is legitimate in digital self-defense? Where does proportionality end? International bodies are trying to establish normative frameworks, but the speed of technology far outstrips that of diplomacy.
What Is Critical Infrastructure?
These are the assets and systems essential for the functioning of a society and its economy: power grids, drinking water systems, transportation, telecommunications, hospitals, banks, and nuclear plants. Their disruption or destruction would have a serious impact on public safety, health, or economic well-being.
The Role of Companies: Security as Business
Companies, for their part, have understood that cybersecurity is no longer an optional expense but a condition for operating. Insurers demand audits; clients demand certifications; investors demand transparency. In sectors like energy or water, where a failure can have catastrophic consequences, digital security has become a boardroom issue. Roles such as Chief Information Security Officer have been created, and cybersecurity budgets grow year after year.
However, the reality is that many critical infrastructures, especially in developing countries, still operate with outdated systems and insufficiently trained personnel. The gap between countries and companies that can afford robust defense and those that cannot is a new source of global inequality. A cyberattack on a hospital in a middle-income country can be as devastating as one on a European power grid, but response capabilities are very different.
What Does This Mean for the World?
Cybersecurity of critical infrastructure has become a matter of national security and global stability. Increasingly, geopolitics is also played out in cyberspace, and a country's ability to protect its power grids, water systems, and hospitals defines its real power against rivals and adversaries. At the same time, international cooperation is limited: information exchanges occur among allies, but there is no effective global mechanism to punish perpetrators or deter future attacks.
For the average citizen, the most visible consequence is that trust in essential services is no longer automatic. Flipping a light switch, turning on a tap, or going to the emergency room implies an act of faith that the systems sustaining modern life will withstand the onslaught of those who want to break them. The question that lingers, while technicians work in silence, is whether we are prepared for the next big attack. And the uncomfortable answer is that we do not know yet.