Hydrogen Cybersecurity | Hybrid and Cyber Risks
June 2026 update: The hydrogen sector's most significant vulnerability
As of June 2026, the hydrogen sector's most significant vulnerability is confidence.
Hydrogen projects depend on investor confidence, regulatory confidence, public confidence, and confidence in the integrity of operational, environmental, and commercial data. Hydrogen remains heavily influenced by expectations about future growth, future demand, future regulation, and future infrastructure development.
This creates an environment in which adversaries do not need to compromise a programmable logic controller, disrupt an electrolyzer, or trigger a physical incident to achieve strategic objectives. Creating uncertainty is sufficient.
Adversaries can achieve strategic objectives through disinformation, manipulated narratives, market manipulation, legal challenges, and supply chain disruption.
This is the reason we must focus on hybrid threats against hydrogen projects.
Most hydrogen security discussions still focus on OT security and industrial control systems, while many of the sector's current strategic vulnerabilities lie at the intersection of technology, finance, governance, public perception, and geopolitics.
The hydrogen sector should view cybersecurity as only one component of a broader hybrid risk environment. The convergence of cyber intrusion, information operations, legal pressure, market manipulation, supply chain interference, and reputational attacks is a greater strategic challenge than any individual technical vulnerability.
The most dangerous vulnerability is the vulnerability that emerges when trust, confidence, and strategic certainty become critical dependencies of an emerging industry.
Hydrogen sector | Hybrid risks
In May 2026, the European Commission selected nine hydrogen production projects under the third auction of the European Hydrogen Bank (EHB). The projects are expected to provide almost 1.1 gigawatts of electrolyser capacity and produce over 1.3 million tonnes of hydrogen over their first 10 years of operation, with an estimated greenhouse gas emissions avoidance of 9 million tonnes of CO2 equivalent.
The selected projects will receive a total of around €1.09 billion in EU funding from the Innovation Fund, sourced from the EU Emissions Trading System (ETS). The produced hydrogen will contribute to EU's clean transition, energy independence and security.
A sophisticated adversary will seek to delay, discredit, divide, discourage, and increase the cost of the projects. Possible attack vectors include:
1. Disinformation and narrative manipulation. This is the easiest and often lowest cost option. Examples include:
1a. Hydrogen projects are unsafe and prone to explosions.
The claim is often simplified to "Hydrogen explodes." Of course, hydrogen does present safety challenges, but so do natural gas, gasoline, LPG, ammonia, and many industrial chemicals.
After hydrogen related incidents, social media discussions frequently amplify the perception that hydrogen is uniquely dangerous, sometimes without technical context. A minor incident can generate headlines suggesting that the technology itself is fundamentally unsafe.
1b. Taxpayer money is being wasted on technologies that cannot work.
Variations include Hydrogen is the next green bubble, and Hydrogen only exists because of subsidies. Some critics move into conspiracy territory by alleging coordinated schemes involving governments, banks, energy companies, and investors.
1c. Hydrogen is a scam benefiting politically connected companies.
1d. The projects will never become economically viable.
Some narratives evolve into categorical claims such as everyone already knows hydrogen cannot work, the industry is hiding the numbers. or the economics have been disproven.
1e. Hydrogen production is actually increasing emissions.
The objective is to create enough doubt that investors hesitate, communities oppose projects, politicians become cautious, and regulators face pressure.
2. Attacks on guarantees of origin and data integrity. Hydrogen projects depend heavily on trust in data. Adversaries target emissions reporting systems, renewable energy attribution systems, carbon accounting records, and guarantees of origin.
Allegations of manipulated data is damaging. If confidence in the answer declines, market value declines as well.
3. Targeting the financing environment. An adversary may attempt to create corruption allegations, controversies, subsidy scandals, and conflicts of interest narratives.
The objective is to create investigations, delays, and political controversy.
4. Supply chain interference. Hydrogen projects depend on electrolyzers, compressors, sensors, industrial control systems, power electronics, and specialized materials. An adversary could disrupt suppliers, compromise vendors, delay deliveries, introduce defective components, and create uncertainty about component reliability.
5. Cyber manipulation of performance data. Sophisticated actors could manipulate efficiency measurements, energy consumption metrics, production forecasts, and maintenance indicators.
The objective could be to make projects appear economically weaker than they really are. This can affect lenders, investors, insurers, and policy makers.
6. Legal and regulatory pressure campaigns. Hybrid adversaries frequently exploit legitimate legal mechanisms. Examples include coordinated complaints, environmental challenges, permitting disputes, competition complaints, and state aid allegations.
The objective is often delay. In infrastructure projects, delay can be as damaging as destruction.
7. Coordinated information operations following minor incidents. Suppose a routine equipment malfunction occurs. A hybrid campaign could rapidly amplify it into proof that hydrogen infrastructure is fundamentally unsafe.
The physical event may be minor. The information effect can become strategic.
8. Energy security narrative attacks. The Commission explicitly links these projects to energy independence and security.
This creates another attack surface. Adversaries could attempt to promote narratives such as:
8a. Europe is becoming dependent on foreign electrolyzer suppliers.
8b. Hydrogen weakens energy security.
8c. Hydrogen investments divert resources from reliable energy sources.
The target is public and political support.
The greatest threat to hydrogen projects is the erosion of confidence in hydrogen infrastructure. A successful hybrid campaign could achieve strategic effects through disinformation, regulatory disruption, market manipulation, supply chain interference, and cyber enabled attacks on data integrity, without causing a major physical incident.
That is precisely why hydrogen cybersecurity should be viewed as only one component of a broader hybrid risk environment.
Hydrogen should learn from the gas electricity interdependency.
The hydrogen industry is dependent on interconnected systems and services that are outside the direct control of hydrogen producers, operators, and infrastructure owners.
In an interdependency hybrid attack, adversaries target one sector in order to create disruptive effects in another sector. They exploit the industry's reliance on external dependencies, achieving operational, financial, regulatory, or reputational consequences without directly attacking hydrogen assets.
The hydrogen sector is particularly exposed to this form of hybrid risk because its operations depend on a complex ecosystem of critical infrastructures. Hydrogen production facilities require reliable electricity supplies, water resources, telecommunications networks, cloud services, industrial control systems, transportation networks, ports, suppliers, certification bodies, and financial institutions. A disruption affecting any of these dependencies may have cascading effects throughout the hydrogen value chain.
For example, a cyberattack against an electricity transmission operator could reduce the availability of power required by electrolysis facilities. Although the hydrogen producer may not have suffered a direct cyber intrusion, production volumes could decline significantly. Similarly, a disruption affecting telecommunications providers could impair remote monitoring capabilities, delay operational decision making, or affect safety systems that depend on real time communications.
The risk extends beyond technical dependencies. The hydrogen industry increasingly relies upon certification frameworks, emissions reporting systems, guarantees of origin, and regulatory compliance mechanisms. Even if physical production remains unaffected, questions regarding data integrity could affect commercial transactions, financing arrangements, and regulatory compliance obligations.
Interdependency attacks may also target logistics and transportation networks. Hydrogen projects frequently depend on specialized equipment, imported components, shipping routes, and port facilities. A disruption affecting a major supplier, transportation corridor, or logistics hub may delay construction schedules, increase costs, and impair operational resilience. In such circumstances, the hydrogen operator may become an indirect victim of an attack directed at a completely different sector.
Interdependency attacks are particularly attractive because they permit adversaries to generate strategic effects while reducing attribution risks. The attacker may not need to compromise hydrogen infrastructure, trigger safety incidents, or cause physical damage. Disruption can be achieved through the exploitation of systemic relationships between interconnected sectors. As a result, the consequences may be substantial even when the immediate target appears unrelated to hydrogen production or distribution.
The growing importance of hydrogen in energy transition strategies, industrial policy initiatives, and energy security planning further increases the significance of these risks. As hydrogen infrastructure becomes more integrated into national and regional economic systems, adversaries may view dependencies as opportunities to create broader disruption, uncertainty, and loss of confidence.
Hydrogen organizations should not limit their risk assessments to threats originating within their own facilities or networks. Effective governance requires the identification, mapping, monitoring, and testing of critical dependencies across operational, technological, regulatory, financial, and supply chain domains. Boards of Directors and senior management should recognize that the resilience of hydrogen operations depends as much on external systems as on the security of their own infrastructure.
The most significant threat may arise from the exploitation of the invisible connections on which the hydrogen industry depends.
It is highly recommended to visit the link below, and study the hybrid stress test that covers critical dependencies.
https://www.gas-cybersecurity.com/Gas_Electricity_Interdependencies.html
From the commitment to reach carbon neutrality to the war in Ukraine
February 2022 was an important month for hydrogen production, distribution, storage, use, research and development. After the outbreak of the war in Ukraine, the European Union decided to phase out Russian energy imports as quickly as possible. The political commitments and decisions to replace fossil fuels were well accepted by all advocates of a clean energy future that ask for the decarbonization of many major industries. Hydrogen plays a key role in this clean energy future.
Technologies for the production, storage, transportation and use of hydrogen as an energy source are available today, but investments are necessary for the broader application that requires scaling up solutions.
Hydrogen may be produced through a variety of processes. Some are clean, some are not so clean:
1. ‘Electricity-based hydrogen’ refers to hydrogen produced through the electrolysis of water (in an electrolyser, powered by electricity), regardless of the electricity source. The full life-cycle greenhouse gas emissions of the production of electricity-based hydrogen depends on how the electricity is produced.
2. ‘Renewable hydrogen’ or ‘Clean hydrogen’ is hydrogen produced through the electrolysis of water (in an electrolyser, powered by electricity), and with the electricity stemming from renewable sources. The full life-cycle greenhouse gas emissions of the production of renewable hydrogen are close to zero. Renewable hydrogen may also be produced through the reforming of biogas (instead of natural gas) or biochemical conversion of biomass, if in compliance with sustainability requirements.
3. ‘Fossil-based hydrogen’ refers to hydrogen produced through a variety of processes using fossil fuels as feedstock, mainly the reforming of natural gas or the gasification of coal. This represents the bulk of hydrogen produced today. The life-cycle greenhouse gas emissions of the production of fossil-based hydrogen are high.
4. ‘Fossil-based hydrogen with carbon capture’ is a subpart of fossil-based hydrogen, but where greenhouse gases emitted as part of the hydrogen production process are captured. The greenhouse gas emissions of the production of fossil-based hydrogen with carbon capture or pyrolysis are lower than for fossil-fuel based hydrogen, but the variable effectiveness of greenhouse gas capture (maximum 90%) needs to be taken into account.
The 8th of July 2020, the European Commission released the communication with title "A hydrogen strategy for a climate-neutral Europe". According to the Commission, hydrogen is enjoying a renewed and rapidly growing attention in Europe and around the world. Hydrogen can be used as a feedstock, a fuel or an energy carrier and storage, and has many possible applications across industry, transport, power and buildings sectors. Most importantly, it does not emit CO2 and almost no air pollution when used. It thus offers a solution to decarbonise industrial processes and economic sectors where reducing carbon emissions is both urgent and hard to achieve.
All this makes hydrogen essential to support the EU’s commitment to reach carbon neutrality by 2050 and for the global effort to implement the Paris Agreement while working towards zero pollution.
Technological developments and the urgency to drastically reduce greenhouse emissions, are opening up new possibilities. Every week new investment plans are announced, often at a gigawatt scale. Between November 2019 and March 2020, market analysts increased the list of planned global investments from 3,2 GW to 8,2 GW of electrolysers by 2030 (of which 57% in Europe) and the number of companies joining the International Hydrogen Council has grown from 13 in 2017 to 81.
In transport, hydrogen is also a promising option where electrification is more difficult. In a first phase, early adoption of a hydrogen can occur in captive uses, such as local city buses, commercial fleets (e.g. taxis) or specific parts of the rail network, where electrification is not feasible. Hydrogen refuelling stations can easily be supplied by regional or local electrolysers, but their deployment will need to build on clear analysis of fleet demand and different requirements for light- and heavy-duty vehicles.
Hydrogen fuel cells should be further encouraged in heavy-duty road vehicles, alongside electrification, including coaches, special purpose vehicles, and long-haul road freight given their high CO2 emissions. The 2025 and 2030 targets set out in the CO2 Emission Standards Regulation are an important driver to create a lead market for hydrogen solutions, once fuel cell technology is sufficiently mature and cost-effective. Projects of the Horizon 2020 Fuel Cells and Hydrogen Joint Undertaking (FCH-JU) are aiming to accelerate Europe’s technological lead.
Hydrogen fuel-cell trains could be developed to more viable train commercial routes that are difficult or not cost-effective to electrify: about 46 % of the mainline network is still being served by diesel technology today. Certain fuel-cell hydrogen train applications (e.g. Multiple Units) can already be cost competitive with diesel today.
For inland waterways and short-sea shipping, hydrogen can become an alternative low emission fuel, especially since the Green Deal emphasises that CO2 emission in the maritime sector must have a price. Scaling up fuel cell power from one42 to multiple megawatts and using renewable hydrogen for the production of synthetic fuels, methanol or ammonia - with higher energy density – are required for longer-distance and deep-sea shipping.
Hydrogen can become in the longer-term an option to decarbonise the aviation and maritime sector, through the production of liquid synthetic kerosene or other synthetic fuels. These are “drop-in” fuels that can be used with existing aircraft technology, but implications in terms of energy efficiency have to be taken into account. In the longer-term, hydrogen-powered fuel cells, requiring adapted aircraft design, or hydrogen-based jet engines may also constitute an option for aviation. To realise these ambitions will require a roadmap for the considerable long-term research and innovation efforts, including under Horizon Europe, the Fuel Cell and Hydrogen Joint Undertaking and possible initiatives as part of the Hydrogen Alliance.
Learn more about hybrid risk
1. Hybrid Risk
4. Defensive Hybrid Intelligence (DHI)
5. Cognitive Intelligence (COGINT)
6. Legal Intelligence (LEGINT)
7. Algorithmic and AI Intelligence (ALGINT)
8. Synthetic Cognitive Intelligence (SCINT)
9. Hybrid Resilience Initiative (HRI)
10. Hybrid Risk Maturity Model (HybRMM)
This website is developed and maintained by Cyber Risk GmbH as part of its professional activities in the fields of risk management and regulatory compliance.
Cyber Risk GmbH specializes in supporting organizations in understanding, navigating, and implementing complex European, U.S., and international risk related regulatory frameworks.
Content is produced and maintained under the professional responsibility of George Lekatis, General Manager of Cyber Risk GmbH, a well known expert in risk management and compliance. He also serves as General Manager of Compliance LLC, a company incorporated in Wilmington, NC, with offices in Washington, DC, providing risk and compliance training in 58 countries.
Cyber Risk GmbH, some of our clients
