Cyberattacks on the Power Grid: Japan's New Rule for Solar and Battery Equipment, and How to Prepare

Hello, this is Ryuta Hamamoto from TIMEWELL.

On 16 October 2026, the Nikkei newspaper ran the headline "Cyberattacks: 100 million weak points in Japan's power grid, with risk rising as batteries and EVs spread." Its message is that if power infrastructure stops, the effect on daily life through blackouts is large, and that the number of possible targets exceeds 100 million.¹ A headline like that can be alarming.

This article separates what has been disclosed from what I could not confirm. It then sets out the new rule the government is bringing in for solar and batteries, and what owners, operators and procurement staff can prepare now, based on public documents. It is not about blaming any country or company. Japan's public documents set requirements by the security of the equipment, not by where it was made, and I follow that approach. Figures and dates are as confirmed up to 21 October 2026.

First, the Nikkei's "100 million"

The Nikkei article is members-only. What I could read for free was the headline and the opening. The basis for the statement that "targets exceed 100 million," meaning what was counted and who estimated it, is in the paywalled part, and I have not been able to confirm it.¹ In this article I mention the figure only as a press headline, so as not to let a number with no confirmed basis travel on its own.

What can be confirmed is in the government's documents.

Facts confirmed in government documents

What has actually happened in Japan

A document from the Agency for Natural Resources and Energy lists domestic threat cases. In May 2024, about 800 remote monitoring devices for solar power facilities were attacked and abused as a stepping stone for fraudulent internet banking transfers. A vulnerability in the remote monitoring devices was exploited. It had been reported before, and several proof-of-concept exploit codes were public. The manufacturer of the attacked devices says that because the devices have no output control function, there was no effect on the grid.²

So the domestic case I could confirm was not an attack that tried to bring the grid down. It was a case in which a small device attached to power equipment was used as a stepping stone for a different crime. But what if a device with the same structure had an output control function? That is why the government is moving quickly.

The government's policy: from April 2027

At its Grid Code Study Group meetings in December 2025 and March 2026, the Agency for Natural Resources and Energy set out making cybersecurity measures for distributed power sources a requirement. The main points are below.²³

Target	Requirement	Start (as the documents state)
Solar, batteries	Use of JC-STAR Level 1 certified products is required for grid connection	April 2027
Solar, batteries (low voltage, under 50 kW)	Same. Allows for distribution stock	October 2027
Wind	Starting with the gateway firewall (or equivalent) at the junction between the wind farm and external communication	April 2027 (proposal)
Fuel cells	Household units, following manufacturers' readiness	April 2028 (proposal)

Wind and fuel cells appear in the March 2026 document as proposals put to the study group. For solar and batteries, the document says it "has been decided" to make the products a required condition from April 2027.³

The scope is products that use IP communication, such as PCS (power conditioning systems) and EMS units. As background, the document gives these points. For commercial installations of 50 kW or more, the technical standard for electrical equipment already obliges cybersecurity. For small solar below 50 kW, both residential and small commercial, the Electricity Business Act has no clear technical standard dedicated to cybersecurity. So work has proceeded toward making the use of JC-STAR certified products a requirement in the grid connection procedure.²

Overseas moves are also in the document. In the United States, a security certification for electronics used in distributed power sources (UL 2941) has been published. In the United Kingdom, a scheme requiring conformity with a security standard (ETSI EN 303 645) for equipment such as batteries is due to apply from 2027. The G7 has also agreed on the importance of taking security measures for IoT products in critical infrastructure.²

What JC-STAR Level 1 is, and its limits

JC-STAR is a labeling scheme that makes the security level of IoT products visible. Applications for Level 1 opened in March 2025. In IPA's description, Level 1 sets the minimum security requirements common to products, and the vendor declares itself that it meets them. It states that the label does not guarantee complete security. A two-dimensional barcode on the label lets you check product information and contacts.⁴

This is an important point. Level 1 is a "minimum standard at the entrance." It does not guarantee safety after installation.

How to think about where equipment comes from

This is a topic people ask about often, so let me set it out here too.

Overseas, there have been reports about solar equipment, Chinese-made equipment in particular, that it may contain communication devices not in the design. In May 2025, Reuters, citing several anonymous sources, reported that undocumented communication devices had been found in some Chinese-made inverters. The number was not disclosed.⁵

Afterward, the US Department of Energy (DOE) had its national laboratories inspect devices and shared the results with energy-sector partners. According to pv magazine's report, about 30 units were inspected, and the finding was that there was "no definitive evidence" of malicious wireless functions. Two communication discrepancies were found, and both were judged "non-malicious" and "non-intentional." The analysis says that undocumented communication in a single inverter is "unlikely" to affect the grid as a whole, while coordinated manipulation across multiple sites could have larger effects. It also warns that supply chain threats remain.⁶

The countermeasures DOE set out are these: check the equipment's communication protocols and disable any that are not needed; analyze the firmware in detail; and where a manufacturer keeps access for warranty or safety, spell out the terms in the contract.⁶

I take two things from this. First, it is wrong to say either "Chinese-made means dangerous" or "Chinese-made means safe." There is no definitive evidence, but checking equipment communications is judged worthwhile. Second, the measures are needed whatever the country of manufacture. Japan's policy also applies the same standard to all covered equipment without distinguishing by country of manufacture. In the documents I checked, no distinction by country of manufacture is written.

Six things for owners, operators and procurement staff to prepare

From here on this is my own arrangement, based on the public documents. These are not procedures set by a standard or a public agency.

1. List your equipment and communication devices.

For solar and battery facilities, write out every device that connects to the internet or a mobile line: PCS, remote monitoring units, gateways, EMS. Include where each is installed, the manufacturer, the model, the firmware version and the person responsible. The device that was used as a stepping stone in 2024 was a remote monitoring unit. Devices that are thought of only as "part of the generating equipment" are easy blind spots.

2. Review initial settings and shut down communication you do not need.

Change initial passwords and disable communication and functions you do not use. DOE also recommends checking a device's communication protocols and disabling any that are not needed.⁶

3. Decide who is responsible for updates.

What was exploited in the 2024 case was a known vulnerability that had been reported before, with proof-of-concept code already public.² Decide who checks the updates the manufacturer issues and by when they are applied. Equipment tends to be treated as "done once installed," so set a person and a frequency.

4. In procurement, look at both the label and the contract.

For facilities connecting from April 2027, JC-STAR Level 1 certified products are expected to be required. Check for the label at the procurement stage. But Level 1 is a self-declaration, not a guarantee, so write into the contract the terms of the manufacturer's remote access, the period for which updates are provided, and how you will be told when a vulnerability is found. DOE also recommends spelling out manufacturer access in the contract.⁶

5. Segment the network and limit outbound communication.

Separate the network for control equipment from the office network, and place defenses such as a firewall at the gateway that connects to the outside. In the wind-power document, the gateway's defensive equipment at the junction with external communication is also the first target.³ Narrow what equipment sends out to what is needed.

6. Manage maintenance contractors' access.

If maintenance is outsourced, the contractor's accounts become an entrance. List who can get into which equipment and when, and delete accounts that are no longer used.

People who have home batteries or solar can apply the same thinking by changing initial passwords and checking for updates.

What executives should confirm

If you invest in or acquire solar or battery businesses, putting the following about the equipment on your checklist reduces rework later: the list of equipment and versions, the update history, the scope of maintenance contractors' access, and the outlook for JC-STAR conformity. A facility connecting from April 2027 onward may be stopped at the grid connection procedure if it lacks the label.

Summary

I could not confirm the basis of the Nikkei's "100 million." What can be confirmed is that in Japan there has been a case in which solar remote monitoring devices were used as a stepping stone for fraudulent transfers, and that the government has indicated it will require JC-STAR Level 1 for solar and battery grid connections from April 2027.

On where equipment comes from, there are both reports of concern overseas and a public agency analysis finding "no definitive evidence." Japan's policy sets requirements by product security without distinguishing by country of manufacture.

I think managing small devices is the entrance to protecting the grid. This week, start by listing the communication devices in your facilities. If you would like to talk through an internal review or procurement rules, please reach out through the consultation form for WARP SECURITY. I will update this article when the government's documents are updated.

References

Footnotes

1. Cyberattacks: 100 million weak points in Japan's power grid, with risk rising as batteries and EVs spread (members-only; only the headline and opening checked; Japanese) — Nikkei — 16 October 2026 ↩ ↩²

2. On making cybersecurity measures for distributed power sources a requirement (Grid Code Study Group, 20th meeting, Document 4; Japanese) — Agency for Natural Resources and Energy — 16 December 2025 ↩ ↩² ↩³ ↩⁴ ↩⁵

3. On making cybersecurity measures for distributed power sources a requirement (Grid Code Study Group, 21st meeting, Document 4; Japanese) — Agency for Natural Resources and Energy — 31 March 2026 ↩ ↩² ↩³

4. Security Requirements Conformity Assessment and Labeling Scheme (JC-STAR; Japanese) — IPA (Information-technology Promotion Agency, Japan) ↩

5. Hidden devices found in Chinese-made inverters in the US, reports Reuters (press report) — pv magazine — 14 May 2025 ↩

6. U.S. authorities find no definitive evidence of hidden devices in Chinese solar inverters (report on DOE's analysis) — pv magazine USA — 28 January 2026 ↩ ↩² ↩³ ↩⁴