Industrial and Energy Sectors: New Risks Related to Smart Energy Meters During the past year, the energy sector faced major challenges related to the impact of the Russian invasion to Ukraine and the subsequent sanctions regime and the rise in energy prices. The situation also became more severe in terms of the number of cyber incidents handled by the NÚKIB. Compared to 2021, the number of recorded incidents increased from three to nine, while the majority consisted of attacks aimed at the availability of services or information. On the other hand, the share of ransomware attacks, which represented a significant threat in the past two years, decreased within the energy and industrial sectors (see Graph 21). 25% 21 20% 15% 10% 6 5% 2 0% 2020 2021 2022 Graph 21: Y ear-on-year Comparison of Recorded Ransomware Attacks or Attempted Attacks Within the Industrial and Energy Sectors (%) The year 2022 has also brought new risks for supply chain security, especially for energy but also other industries. There is currently an ongoing debate surrounding the so-called smart meters, especially about procurement and use of secure devices (see Box). The proliferation of these components, which according to current legislation must be deployed at consumption points with demand of more than 6 MWh by 2027, means that it is necessary to consider their cybersecurity as well. The main challenge is to ensure the security of the supply chain, because a significant number of these smart meters will be installed in the Czech Republic in the coming years and will eventually form a significant part of the energy distribution system. Smart Meters Smart electricity meters are currently a relatively dynamic and expanding element of the energy distribution network digitalization. They represent an essential element of smart grids; their main purpose is to provide up-to-date information on the load on the system, to ensure better control, security, and stability of the grid, but also to provide feedback on energy consumption to end customers. However, smart meters also pose some risks, as they are relatively simple devices connected to the internet. They can therefore become the target of cyberattacks, with potential consequences including not only leaks of sensitive data, but also, in extreme cases, physical damage to the distribution network in the event of improper handling. The potential risk of supply chain compromise exists in particular for companies based in countries whose political and legal environment requires them to cooperate with local security or government authorities at the expense of the privacy or security of the company’s customers. However, a threat is also posed by companies that, through their ownership structure or business cooperation, effectively form an intermediate link in the supply chain between the Czech Republic and countries with the above-described high-risk political and legal landscape. Both of these risks are currently monitored by the NÚKIB, which raised the issue in 2022 by means of a warning for domestic entities. 25