The attack took a day; getting back on the grid has taken 62 days
Chile's 103 MW Huatacondo solar plant remains offline 62 days after the August 27 cyberattack, and its 98 MW / 312 MWh battery system, then in commissioning, has not been reconnected. In October, three grid-connected companies updated their firewalls.
Everything that follows appears in the official daily reports of the Dispatch and Control Center of Chile’s system operator, the Coordinador Eléctrico Nacional, a public record anyone can verify.
On August 27, those reports logged events whose reported cause was a cyberattack. Since late June, they had logged no others with that cause.
What follows in the reports is not another attack. It is the same asset, every morning. The 103 MW Huatacondo solar plant, in the municipality of Pozo Almonte in Chile’s Tarapacá region, appears as unavailable due to the cyberattack in every daily report from August 27 to October 28, at 0% availability. As of October 28, no return to service has been logged. That is 62 days.
Next to the plant sits the Huatacondo battery energy storage system, rated at 98 MW / 312 MWh. It was not in commercial operation: it was in commissioning, energized for testing. The attack disconnected it as well, and as of October 28 it is still in commissioning, with no reconnection logged.
On October 29, the Chilean outlet Recargados covered the case under the headline “A cyberattack took 312 MWh of batteries offline in Chile, and two months later they are still down” and cited our August 31 analysis. The cause is the one the company reported to the system operator. There is no public investigation into its origin or scope, and this analysis does not offer one.
One day to get in, more than two months to come back
The attack was logged at a single point in time on a single day. The return is measured in weeks and still has no date.
Coming back does not mean the same thing for the two units. For the solar plant, it means reconnecting a plant that was operating. For the battery, it means resuming a commissioning process that was interrupted. As Recargados notes, several parties have access to the systems at that stage, which lengthens the work of verifying that nothing was altered.
Recargados explains what that return requires. Re-energizing a battery system after a cyber incident means verifying that the firmware, protection settings, and control logic were not altered, and part of the testing may need to be repeated.
That reading fits how such a facility is built. A battery storage system is several layers that talk to one another: the cells and their management system, the inverter, the protection relays, the plant controller, and the link to the control center. If any of those layers may have been touched, the question is no longer whether the equipment works, but whether it does what its configuration says. Answering it requires a sequence, and the least trusted layer sets that sequence. This last point is our reading of how verification works: the daily reports do not say what is being reviewed or how far along it is.
Three firewalls in five days
Between October 23 and 27, the daily reports logged three firewall updates at substations of three different grid-connected companies. Each one filed an emergency outage request and closed it the same day or the next.
- October 23: a Fortinet unit was updated for a “possible vulnerability to cyberattacks.” It took 46 minutes.
- October 26: a Fortinet unit was updated for a “critical security vulnerability.” It took 45 minutes.
- October 27: a firmware update on a corporate firewall, following a communications outage. It took 3 hours and 41 minutes.
We do not name the companies or their substations: publishing which equipment protects each facility is useful information for an attacker. The records are in the system operator’s daily reports for those dates.
None of them disclosed a vulnerability identifier, so the daily reports do not show what was fixed. Since late June, the daily reports had logged no update of this kind. The absence of a log entry does not prove such work never happened, since not every update of this kind requires an emergency outage request. What it does show is that in October this work started to appear in the official record.
Separately, on October 23 the Canadian Centre for Cyber Security published advisory AV26-1081: FortiOS and other Fortinet products were affected by vulnerabilities as of October 21, and recommended updating. For FortiOS, the fixed versions are 8.0.2, 7.6.8, 7.4.13, and 7.2.14. The daily reports do not say whether the updates logged in Chile were a response to that advisory.
The standard is still on its way
The CNE’s power-sector cybersecurity standard opened for public consultation on August 28, the day after the events, and the consultation period was extended to October 2. As of this writing, it has no final version. According to Recargados, the first maturity assessment is scheduled for 2028.
Until then, how long an asset takes to come back depends not on a common requirement but on what each company has prepared: its practices, its contracts with suppliers, and what it has already rehearsed.
Two questions for every company
The first is what each month with an asset offline costs. A plant stops selling its energy; a battery system stops charging in low-price hours and discharging in high-price ones; and one still in commissioning pushes back the date it starts earning revenue. The figure depends on each contract and cannot be derived from the daily reports.
The second is who, inside the organization or among its suppliers, knows the way back: what gets checked first, what evidence goes to the system operator, which tests are repeated, and who signs off.
Further reading
- Grid cybersecurity: Chile’s new standard reaches consultation as the sector already reports attacks (August 31, 2026)
- Cybersecurity in energy assets: beyond regulatory compliance
- Designing tomorrow’s Chilean power system today
Sources: official daily reports of the Dispatch and Control Center of Chile’s Coordinador Eléctrico Nacional, in particular those for August 27 and October 23, 26, 27, and 28, 2026; Recargados, “Un ciberataque apagó 312 MWh de baterías en Chile y llevan dos meses sin volver,” October 29, 2026; Canadian Centre for Cyber Security, advisory AV26-1081, October 23, 2026; Comisión Nacional de Energía (CNE), draft Technical Standard on Cybersecurity and Information Security, public consultation from August 28 to October 2, 2026.