EU: ageing IT systems in critical infrastructure make them vulnerable to Russian sabotage

On 5 December 2025, L’Usine Digitale analysed a report from the International Institute for Strategic Studies (IISS) on sabotage operations against European critical infrastructure attributed to Russia. The document notes a sharp increase in these attacks. While most remain physical, they increasingly target the IT systems of sensitive industrial installations—energy, transport, communications, or submarine cable networks.

The IISS also stresses that the obsolescence of certain industrial control systems makes them vulnerable to future targeted attacks. Underinvestment in renewing equipment—often old and deeply interconnected—creates a high risk of sabotage, particularly for electricity, water, and transport networks.

The cybersecurity of critical infrastructure also suffers from significant fragmentation within the EU: protection levels and national resilience frameworks vary widely from one country to another. Many private operators manage these sensitive systems, further complicating any attempt at standardisation.