Cyberattack and Two Months Offline: What Huatacondo Reveals About Plant Availability

Reporting: a long interruption, a limited public record

Huatacondo in Chile brings the availability question into sharp focus. ESS News and pv magazine reported on 29 October that the 103 MW photovoltaic plant and its associated 98 MW / 312 MWh battery energy storage system remained disconnected two months after an incident recorded as a cyberattack. According to their accounts of Chile’s National Electric Coordinator data, the 27 October daily report listed forced disconnection and 0% availability for both installations. The incident had been reported on 27 August. [1][2]

This is a reported operational status at a specific observation date. It is not a forensic explanation of the outage, and it does not establish that the installations are still offline on 3 November. The coordinator’s records document causes communicated by operators; the reports alone cannot determine the technical nature or full scope of the incident. [1][2]

The battery was still being commissioned

The storage distinction is essential. ESS News states that the BESS was undergoing commissioning when the incident occurred and was still listed in that status on 27 October. Its unavailability must therefore not be described as two months of interrupted established commercial storage production. The published capacity figures also do not quantify lost energy, revenue or damage. This article makes no estimate of those losses. [1]

What remains unconfirmed

The cited reporting does not publicly confirm the attack method, the affected component, the concrete extent of the attack or a restart date. A remote-access compromise, ransomware, destroyed hardware or a particular supplier’s vulnerability would all be speculation here. Other cyber-related entries on the same day do not establish a shared attacker or a coordinated attack. The length of an interruption cannot, by itself, explain why recovery took time. [1][2]

Analysis: availability includes the ability to recover

For operators, digital security is an economic operating question, not only an IT task. A recovery plan needs to connect engineering, operations, cybersecurity and external service providers. Commissioning deserves the same clarity about access and responsibilities as regular operation: temporary accounts and changing configurations should not become unmanaged dependencies. These are editorial lessons, not confirmed explanations of Huatacondo.

Controlled remote maintenance, segmentation, defined roles and rehearsed emergency processes are complementary measures. Their practical value depends on the actual interfaces and operating constraints. Restoration should mean a verified, safe configuration and an agreed return-to-service procedure—not simply getting a network connection back. No single product can be credited with preventing this reported incident.

• Who can change plant settings remotely, and who approves and revokes that access?
• Which dependencies connect the PV plant, battery controls, business IT and supplier services?
• Are configuration backups, emergency contacts and safe restart responsibilities documented and tested?
• Which availability assumptions apply during commissioning, and which apply after commercial acceptance?

A cross-sector question, not a product promise

The companion article on European supermarket refrigeration looks at digital interference with physical processes. The equipment and incidents are different; the shared operator question is how access, detection and response are governed. SaiFlow Security and Secure Remote Access may be discussed for a project-specific assessment of energy infrastructure, but this reporting does not show that SaiFlow could have prevented the Huatacondo incident.