RDI Warns of Cyber Risks in High-Power IoT Devices

The Rijksinspectie Digitale Infrastructuur (RDI) has warned that a single faulty update or cyberattack can affect thousands of home batteries, inverters, charging points, and heat pumps simultaneously. The risk lies not in individual devices but in the shared servers and software used to remotely control large numbers of devices. This creates a single point of failure.

A home battery is often sold as a box with cells, an inverter, and a guarantee. However, it is increasingly common for a household to also purchase a digital service. The manufacturer can update firmware, an energy manager determines when the battery charges, and a trading service can control thousands of systems simultaneously. This makes the battery smarter and sometimes more profitable, but also dependent on parties that are not visible in the meter box.

The RDI has identified five links in the chain with access or influence: manufacturer, energy management system, cloud platform, aggregator, and installer. Not every installation uses five separate companies. The roles can overlap. For a consumer, the question remains: who can change settings, who can update software, and what will continue to work locally when one link fails?