I attended an electricity conference on Thursday, in which the Polish grid operator shared great data on how late 2025 various parts of their grid got hacked. They have bravely explained the mundane problems that made them vulnerable: default passwords, password reuse, missing patches etc. And I assure you, everyone has these stupid mistakes. Fix the basics first and then worry about super-duper attackers. Glorious details in here: https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/