Energy and Utilities Cyber Statistics: Sourced Figures on Espionage, Ransomware and Recovery

Energy and utility operators are targeted for espionage and pre-positioning as much as for money, yet many board papers still quote cross-industry averages that hide what is different about the sector. This page collects energy and utilities cyber statistics from primary publishers: the Verizon 2026 Data Breach Investigations Report (DBIR) Utilities snapshot, the Dragos 2026 OT Cybersecurity Year in Review, the Sophos State of Ransomware in critical infrastructure survey for energy, oil and gas and utilities, and Check Point Research attack telemetry for US utilities. Each figure carries its publisher, report and period, and vendor surveys are labelled as such. It is written for utility CISOs, OT and grid security leads, risk teams and regulators who need defensible numbers for investment cases. For cross-sector plant floor figures (advisories, exposure, OT detection), read the OT and ICS Security Statistics Guide; this page covers only what is specific to energy and utilities. Last reviewed: November 2026.

Key takeaways

• Espionage, not money, leads utility breaches. The Verizon 2026 DBIR finds an espionage motive in 71% of Utilities breaches against a financial motive in 36%, the reverse of the Professional services snapshot in the same report (financial 96%, espionage 5%).
• Secrets are the prize. Secrets appear in 68% of Utilities breaches and internal data in 85% (Verizon 2026 DBIR), which points to credentials, keys and engineering data being taken for later use.
• Named state groups are inside energy networks. Dragos reports SYLVANITE extracting Active Directory credentials at US electric and water utilities and passing access to VOLTZITE, which reached US midstream pipeline operations through cellular gateways.
• Ransomware recovery is slow and expensive. In the Sophos 2024 survey of 275 energy, oil and gas and utilities organisations, median recovery cost reached USD 3 million, four times the cross-sector median, and 55% took more than a month to recover.
• Attack volume is climbing. Check Point Research data reported by Reuters gave an average of 1,162 cyberattacks on US utilities through August 2024, up nearly 70% from 689 in 2023 (single source; the averaging unit is not stated in the report).

Headline statistics

Statistics by theme

Breach patterns and motives

• What stands out: the Verizon 2026 DBIR covers October 2024 to November 2025 and more than 22,000 confirmed breaches across 145 countries. In its Utilities snapshot, espionage outweighs financial gain by about two to one, and motives overlap, so the two percentages add to more than 100%.
• Personal data barely features: the Utilities data types are internal data, secrets and other, with personal data not among the top categories listed. Breach notification metrics driven by personal records will undercount utility incidents.
• Cross-industry context: across all sectors the same report puts ransomware in 48% of breaches, third-party involvement in 48% and vulnerability exploitation at 31% of initial access. Verizon does not publish Utilities-only figures for those measures in its executive summary, so do not quote them as utility numbers.

State groups and OT intrusions

• Source and naming: all rows come from the Dragos 2026 OT Cybersecurity Year in Review press release (17 February 2026), listed alphabetically. Dragos tracks activity groups by behaviour; government and other vendors use different names, and VOLTZITE overlaps with activity governments call Volt Typhoon. See the Volt Typhoon Threat Actor Profile and the Energy Sector Threat Actors Guide.
• Stage 2 matters: in the ICS Cyber Kill Chain, Stage 2 means the group has moved from IT access to developing and testing the ability to affect industrial processes. Dragos's elevation of VOLTZITE marks a shift from pre-positioning towards capability.
• Distributed energy exposure: Dragos found more than 100 internet-exposed battery energy storage devices, including inverters of about 1 MW supplying grid power to electric utilities. See the Battery Energy Storage System Security Guide and the Distributed Energy Resources and Solar Inverter Security Guide.

Ransomware, cost and recovery

• Survey basis: the Sophos critical infrastructure figures (press release, July 2024) come from 275 energy, oil and gas and utilities respondents within a survey of 5,000 IT and security leaders across 14 countries and 15 sectors, carried out in January and February 2024. It is a vendor survey; percentages describe respondents, not the whole sector. Check for a newer Sophos sector edition before quoting.
• Industrial ransomware trend: Dragos counts 119 ransomware groups targeting industrial organisations in 2025, up from 80, affecting about 3,300 organisations, with ransomware attacks on industrial organisations up 64% year on year. Manufacturing makes up more than two thirds of victims, and Dragos does not break out an electric or oil and gas figure in its release.
• Breach cost: IBM's Cost of a Data Breach Report 2026 puts the global average at USD 4.99 million, a 12% increase and a record high. Use an energy-specific IBM figure only from IBM's own report.
• The archetype: the Colonial Pipeline Ransomware Attack 2021 began with a legacy VPN account without MFA whose password had leaked, and led to a precautionary pipeline shutdown from 7 to 13 May 2021 although the ransomware hit IT systems.

Attack volume

• US utilities: Check Point Research data reported by Reuters on 11 September 2024 shows an average of 1,162 attacks on US utilities from January to August 2024 against 689 in the same period of 2023, an increase of nearly 70%. Reuters does not say what the average is taken over (for example per week or per organisation), so treat it as a trend indicator only; this is a single-source vendor figure. These are attacks detected by Check Point's sensors, not successful compromises.
• How to use it: telemetry counts show pressure on the perimeter and are useful for trend arguments. They cannot be compared with breach counts from Verizon or with survey percentages from Sophos.

What the numbers mean for defenders

• Small versus large utilities: a municipal utility or small generator gets most from removing internet exposure on remote access and cellular devices, MFA on every VPN, KEV-driven patching and offline backups of control system configurations. A large utility or pipeline operator also needs a separate OT identity domain, continuous OT network monitoring, a managed secrets programme for service accounts and an exercised grid or pipeline restoration plan. See the Electric Utility Cybersecurity Programme Guide.
• Where identity fits: the leading utility data type in the DBIR is secrets, and the Dragos groups above moved with stolen Active Directory credentials and remote access accounts, as Colonial Pipeline's dormant VPN account showed. Machine identities, service accounts and vendor accounts are the bridge from IT to OT. See the Energy Sector Identity and OT Access Guide.
• Regulation: North American bulk electric operators work to NERC CIP and US pipelines to TSA security directives, which define much of what is measured and reported. See the NERC CIP Guide and the TSA Pipeline and Rail Cybersecurity Directives Guide.

How to turn these statistics into a programme:

1. Baseline your own numbers: count internet-exposed remote access and cellular devices, open KEV entries on edge appliances, service accounts with non-expiring passwords, and sites whose backups were last restored more than a year ago.
2. Remove exposure first: take cellular gateways and remote access devices off the open internet or behind a broker, verify with an external scan, and keep a documented fallback for field crews before cutting access.
3. Bring secrets under management: start with service accounts that cross the IT and OT boundary, vault them, rotate in a maintenance window with the old credential held for rollback, then extend to engineering workstations.
4. Separate identity domains: pilot an OT domain at one site, migrate accounts in monitor mode and keep the old trust disabled rather than deleted until operations confirm stability.
5. Exercise restoration: run a tabletop covering ransomware on IT with a precautionary OT shutdown, decide in advance who authorises restart, and refresh this page's figures when each publisher releases its next edition.

Metrics that show the programme is working:

• Exposure: internet-reachable OT, cellular and remote access devices, target zero unbrokered.
• KEV backlog: open KEV-listed vulnerabilities on edge appliances past the CISA due date.
• Secrets hygiene: share of IT and OT service accounts vaulted and rotated within policy.
• Restore readiness: share of sites with a successful control system configuration restore in the last 12 months.
• Detection coverage: share of substations, plants or compressor stations with OT network monitoring feeding the SOC.

Common failure patterns when using energy statistics

• Using cross-industry ransomware figures as utility figures: the DBIR's 48% ransomware share and IBM's global average are not utility numbers. Use the Utilities snapshot and sector surveys.
• Framing the risk as purely financial: with espionage in 71% of Utilities breaches, a programme sized only against ransomware loss underestimates pre-positioning and data theft.
• Counting personal records as the impact measure: utility breaches mostly take internal data and secrets, so notification counts understate them.
• Quoting old survey years as current: the Sophos energy figures are from 2024 fieldwork. Always state the edition.
• Ignoring the IT side: most OT impact starts with IT credentials and edge devices, as the Colonial Pipeline Ransomware Attack 2021 showed. A programme that only measures the plant floor misses the entry route.

Methodology notes and caveats

Practitioner checklist

• Quote each figure with publisher, report and edition, and say whether it is breach data, survey or telemetry.
• Use the Verizon Utilities snapshot, not the cross-industry headline, for sector claims.
• Size the programme for espionage and pre-positioning, not only ransomware.
• Remove internet exposure from cellular gateways, remote access and DER devices.
• Patch edge VPN appliances against the CISA KEV catalogue first.
• Vault and rotate service account credentials that cross the IT and OT boundary.
• Keep offline, tested backups of control system configurations and historians.
• Exercise a precautionary shutdown and restart decision at least yearly.
• Refresh this page when Verizon, Dragos, Sophos or Check Point publish a new edition.

Standards and references

• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Dragos: 2026 OT Cybersecurity Year in Review press release
• Sophos: Median recovery costs for energy and water critical infrastructure sectors
• IBM: Cost of a Data Breach Report
• Reuters via ThePrint: Cyberattacks on US utilities surged 70% this year, says Check Point
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: OT and ICS Security Statistics Guide, Energy Sector Threat Actors Guide, Energy Sector Identity and OT Access Guide, Electric Utility Cybersecurity Programme Guide, Ransomware Statistics Guide.