Europe's centralized grid remains its vulnerability
Employees repair sections of the Darnytska combined heat and power plant damaged by Russian airstrikes in Kyiv, Ukraine, on Feb. 4, 2026. (Roman Pilipey / AFP via Getty Images)
on Google
Miro Sedlak
Senior energy sector executive
Ukraine has now survived four winters of systematic Russian strikes on its energy infrastructure.
This past winter was especially challenging. The United Nations documented near-daily strikes on energy infrastructure across 17 regions in January alone. In Kyiv, repeated attacks on two combined heat and power plants cut central heating to nearly 6,000 residential buildings each time. All 15 of Ukraine's thermal power plants have now been damaged or destroyed.
Yet Ukraine managed to adapt — and built something Europe still lacks.
Ukraine has now survived four winters of systematic Russian strikes on its energy infrastructure — and in doing so has begun developing something no European country possesses: an operational doctrine for keeping cities warm under attack.
When centralized heat plants became high-value targets, Ukrainian operators pivoted to municipal cogeneration units — compact systems generating both electricity and heat independently of the wider grid.
By November 2025, the district heating sector was operating 182 such units alongside 239 block-modular boilers, forming autonomous "energy islands" for hospitals, water utilities, and residential buildings.
Where European procurement cycles measure deployment in years, Ukrainian operators install modules in days. They improvised under fire: pre-positioning spare parts, establishing emergency communication protocols, cutting through bureaucratic hierarchy with municipal-level decision-making.
The IEA identifies these emergency response capabilities as among the most transferable elements of Ukraine's energy defense. Transferable — but to whom, and how fast?
Across Central and Eastern Europe (CEE), district heating is the primary way cities stay warm. Poland, Slovakia, the Czech Republic, Hungary, and the Baltics all depend on centralized systems built in the Soviet era. This is the very same architectural logic that made Ukraine's infrastructure a high-value target — not just to missiles and drones, but to cyberattacks as well.
Modern heating plants are operated through industrial control software that regulates temperature, pressure, and flow remotely. That digital layer is already being exploited.
In January 2024, a previously unknown malware called FrostyGoop targeted heating systems in Lviv by hijacking Modbus, a communication protocol widely used to control industrial equipment. It shut down heating to over 600 apartment buildings for two days. Researchers later found heating controllers running the same protocol, exposed to the open internet, in Lithuania and Romania.
Three days before this year began, a coordinated cyberattack targeted a large Polish combined heat and power plant serving nearly half a million customers. The attackers — attributed to an FSB-linked group — had been inside the network since March 2025, mapping systems and stealing credentials.
Wiper malware was deployed to make systems irreversibly useless. The plant's endpoint detection software caught it in time. Most municipal heating operators across the continent don't have those means.
Ukraine knows what these attacks look like, how they escalate, and how to keep heat flowing despite them. That knowledge is not reaching the European providers who need it, yet not nearly fast enough.
There are a few structural problems. Europe's heating sector is fragmented: state-owned providers in major cities, large private players like Veolia and Engie, municipal operators — the largest group across CEE — and small local owners who bought plants in the privatizations of the 1990s.
Municipal operators are the weak link. They answer to city councils, not national governments. They have no mandate for international knowledge exchange, no budget for it, and no institutional counterpart to call in Kyiv.
They invest largely only when EU subsidy schemes are available, for infrastructure that is often decades old. When you're managing 50-year-old pipes and production technology, cybersecurity is not your first priority. It isn't even your second. These are small companies in district towns with no capacity to spare, often led by managers who are consumed by day-to-day operational fires.
Some of them know the threat exists, yet nearly none of them have a mechanism to act on it.
The institutional infrastructure for knowledge exchange technically exists. The Energy Community Secretariat connects Ukraine to its European neighbors and has signed memoranda on district heating coordination. The EU's Preparedness Union Strategy sets out 30 actions for crisis resilience. But these connect governments (not the engineers and dispatchers) who actually run the systems.
EU preparedness policy flows top-down, which doesn't effectively address local heating vulnerability. No one's job description includes connecting a Ukrainian cogeneration operator with a heating company in Poland or Slovakia.
Meanwhile, proposals for joint European cyber defense are on the table, and several EU member states are building offensive cyber deterrence. But the pace does not match the threat. And again, these initiatives operate at the strategic level — not at the municipal heating layer where the vulnerability is the largest.
Now, the question is: what needs to be done? Going back to Ukraine, Kyiv is no longer improvising.
On March 3, President Volodymyr Zelensky chaired a National Security and Defense Council meeting that approved regional energy resilience plans for every Ukrainian region, built around four pillars: critical infrastructure protection, additional cogeneration capacity, decentralized heat supply, and decentralized water supply.
What's missing is the operational link between Ukraine's hard-won knowledge and the European providers who need it. A mechanism that moves lessons from Kyiv's dispatchers to heating operators in Bratislava, Lodz, and Vilnius.
Next winter is six months away. Ukraine was forced to become Europe's laboratory for district heating under a hybrid attack. And the question today is whether Europe absorbs those lessons before it has to learn them firsthand.
The transfer would benefit Ukraine as well. Closer operational ties with European heating operators would embed Ukrainian expertise into EU preparedness frameworks.
This would also strengthen Kyiv's case for integration, building institutional relationships that outlast the current crisis, and ensuring that Ukraine's reconstruction draws on European investment already shaped by shared operational knowledge.
Editor's note: The opinions expressed in the op-ed section are those of the authors and do not purport to reflect the views of the Kyiv Independent.
read also
Luca Léry Moffat
Tanya Kozyreva
Kollen Post
