Czech cyber agency NUKIB flags Chinese espionage risks to critical infrastructure

According to Czech cybersecurity agency NUKIB, Chinese-linked technologies pose growing risks to critical sectors such as energy, healthcare, transport and government, with devices including IP cameras, PV inverters, smart meters and other connected technologies identified as risky. The agency warns that widespread use of these technologies means suppliers can influence operations and access data in critical infrastructure, especially as many systems rely on cloud storage and remote connectivity.

It notes that data transfers and remote asset control by China-linked threat actors are a concern, and lists examples such as IP cameras, PV inverters, smart meters, healthcare devices, cloud storage and large language models as potential risk factors.

APT31, also known as Zirconium or Judgment Panda, is cited as having conducted cyber operations affecting Czech ministries and NATO allies, with May 2025 seeing a government condemnation of China after the group was linked to a cyberattack targeting national infrastructure. The EU, its Member States and NATO Allies expressed support for Czechia after the incident, while authorities emphasised the need for protective measures even if bans are not in place.