Industrial ransomware rises 87% and 64%, and REN 964 already requires a board-approved policy

Vestas argues for bringing cybersecurity into the senior leadership decisions of wind generators, because SCADA and remote access widen the exposure of wind farms. The post, by A2TM Corretora de Seguros, cites Dragos, with an 87% rise in ransomware against industrial organisations in 2024 and a further 64% in 2025, and IBM, with an average cost of USD 4.83 million per breach in the energy sector.

In Brazil, the regulatory requirement already exists. ANEEL Normative Resolution No. 964, of 14/12/2021, in force since 1/7/2022, began requiring agents to have a cybersecurity policy approved by the board of directors, a response plan and notification of higher impact incidents. Order No. 427/2025 gave agents until 30/6/2025 to report implementation.

For those who operate wind farms, the risk is operational and financial. An incident that takes turbines out of operation affects availability and revenue, and insurance cover depends on the conditions and exclusions of each policy, as the post points out.

An approved policy meets the rule. Controlled and tested remote access protects generation.