Testing of Seawater Electrolysis Stack Incorporating the Research Team’s Developed Electrode. Credit: KIER
Dr. Ji-Hyung Han’s research team from the Korea Institute of Energy Research has developed a high-performance carbon cloth-based electrode that maintains stable performance even under high current conditions. The newly developed electrode is the first seawater electrolysis electrode using a carbon cloth support that has demonstrated successful continuous operation for over 800 hours under high current conditions, highlighting its potential for commercialization.
The research is published in the journal Applied Surface Science.
Water electrolysis is an eco-friendly technology that produces hydrogen by splitting water. Although it primarily relies on freshwater, growing concerns over global water scarcity have drawn increasing attention to seawater electrolysis, which uses seawater directly.
The performance and lifespan of seawater electrolysis systems depend heavily on the catalyst used in the electrode and the electrode support that evenly distributes the catalyst. While precious metal-based catalysts such as platinum and ruthenium are commonly used, recent research has focused on non-precious metal catalysts or approaches that minimize the use of precious metals due to cost concerns.
There are also issues with the electrode support. Metal-based supports are highly vulnerable to corrosion caused by chloride ions, clearly limiting their lifespan. As an alternative, carbon cloth has emerged due to its excellent electrical conductivity, corrosion resistance, flexibility, and cost-effectiveness.
However, existing carbon cloth-based catalysts have faced challenges in commercialization, as they suffer from performance degradation and structural damage during high-current operation (above 500 mA/cm²) and long-term use over 100 hours, which are required for industrial applications.
Schematic of the Electrode Fabrication Process Using the Developed Catalyst. Credit: KIER
Catalyst Developed by the Research Team. Credit: KIER
The research team overcame the limitations of conventional electrodes by developing a carbon cloth-based electrode with enhanced hydrogen production efficiency through an optimized acid treatment process. The newly developed electrode reduced the overpotential applied to the electrode by 25%, enabling a 1.3 times more efficient hydrogen evolution reaction (HER) compared to existing electrodes.
To enhance the reactivity of the electrode, the research team focused on acid-treating the carbon cloth. The acid treatment involves immersing the cloth in a highly concentrated nitric acid solution at 100°C for one hour. However, evaporation during the process caused fluctuations in acid concentration, which posed a challenge. To address this, the team designed a specialized acid treatment vessel that prevents concentration changes, successfully optimizing the surface treatment of the carbon cloth support.
The acid-treated carbon cloth support exhibits high hydrophilicity, which promotes the uniform distribution of cobalt, molybdenum, and ruthenium ions across its surface. In particular, the precious metal ruthenium is evenly dispersed throughout the support, enabling excellent electrochemical performance even with a minimal amount.
As a result, the ruthenium-incorporated cobalt-molybdenum (CoMo) catalyst achieved a roughly 25% reduction in overpotential compared to conventional CoMo catalysts, despite using only about 1% ruthenium by weight. By lowering the required overpotential, the catalyst enabled a hydrogen evolution reaction that is approximately 1.3 times more efficient at the same current density.
The catalyst-coated electrode maintained its initial performance even after over 800 hours of continuous operation under high current conditions of 500 mA/cm². Post-operation analysis of the electrode revealed no leaching of metal ions such as ruthenium and cobalt into the electrolyte, indicating excellent corrosion resistance and structural stability. Additionally, the team successfully synthesized a large-area electrode measuring 25 cm², showing potential for scalability and practical application.
Dr. Han of KIER stated, “This technology marks the world’s first successful case of long-term operation over one month under industrial-level high current conditions in seawater electrolysis using a carbon cloth-based electrode. We plan to further advance the technology to the demonstration level through extended durability testing beyond 1,000 hours and research on scaling up to large-area cell modules and stacks.”
More information:
Hyunji Eom et al, Ru-modified CoMoOx catalyst on carbon cloth for efficient HER in alkaline seawater electrolysis at high current densities, Applied Surface Science (2025). DOI: 10.1016/j.apsusc.2025.163534
Citation:
High-performance electrodes for seawater electrolysis can improve hydrogen production (2025, August 14)
retrieved 14 August 2025
from https://techxplore.com/news/2025-08-high-electrodes-seawater-electrolysis-hydrogen.html
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no
part may be reproduced without the written permission. The content is provided for information purposes only.
Setup was relatively quick and painless. You just have to unbox four speakers, a soundbar, and a subwoofer, attach their power cables, and plug in everything. Pairing happens through the LG ThinQ app, which allows you to set up the Sound Suite system and tune it to exactly where you’re sitting in the room using your cell phone’s microphone.
You can also set up each speaker to play music and group it with any other LG smart speakers you might have around your home, like the more affordable $250 M5 bookshelf speaker, to create a whole-home system.
Once all the components were synced, I plugged the soundbar into the C5 OLED via HDMI, and was able to easily control everything via the TV remote’s volume and mute buttons. More in-depth settings had to happen in the app, but if you’re anything like me, this won’t become a regular chore. You’ll set it how you like it once and move on. While the pairing functionality with the LG TV was nice, it’s not required–the eARC port lets the Sound Suite work perfectly with any modern TV.
The bar itself runs the show, with a black-and-white display on the far left that shows your mode and volume, among other settings. In the center of the bar and below each speaker, an LED light strip that also shows you the volume when you change it, which is a nice touch.
Getting Musical
Photograph: Parker Hall
The sound of the LG Sound Suite is full and cinematic, thanks in no small part to the extra dedicated speakers. Most competitors lack front left and right, simply opting to use the soundbar for these channels. As such, the width and breadth of the soundstage were bigger than most competitors I’ve tried, with only Samsung’s flagship HW-Q990F as a real contender. Even the Samsung lacked the lower-frequency audio quality that these LG speakers provide.
On 27 April, the government backed security certification scheme, Cyber Essentials v3.3, takes effect and multi-factor authentication (MFA) becomes a pass-or-fail requirement for the first time.
If a cloud service your organisation uses offers MFA and you have not enabled it, you fail. No discretion, no partial credit, no route to remediate inside the assessment cycle.
This is the right call. I want to say that clearly, because what follows is a problem with the implementation, not the policy. MFA is the single most effective control against credential-based attacks, and the scheme has needed to stop tolerating its absence for a long time. The National Cyber Security Centre (NCSC), part of GCHQ, which developed Cyber Essentials and certification company, IASME have got this decision right.
But in the assessments we have conducted this year, I have seen two organisations that will hit a wall on 27 April, and I do not think they are unusual.
Train company could not deploy MFA
The first is a train operating company in the South East. Station operations rooms run on shared terminals where staff rotate through shifts in time-critical conditions. A transport union raised formal concerns that MFA would introduce delays at the keyboard that could affect train operations and, in their view, the safety of train movements.
The company listened and chose not to enable MFA in those environments. Under v3.2 they passed, with the relevant questions marked as non-compliant but not fatal. Under Cyber Essentials v3.3 they will fail.
Charity run by volunteers faces MFA hurdle
The second is a nationally known charity with hundreds of high street shops. The shops are staffed largely by volunteers many of whom work a few hours a week, and staff turnover is high.
The cost and management overhead of enrolling every volunteer onto MFA, using personal phones they may not have and authenticator apps they would not keep, was considered prohibitive. So MFA was never switched on. Same story: they passed under v3.2. Under v3.3 they fail.
Neither of these organisations is ignoring security. Both made considered decisions based on how their people actually work. The problem is not that they do not want to comply. It is that the standard toolkit of MFA methods, including SMS codes, authenticator apps on personal phones, and push notifications, does not fit a six-person shared terminal that has to be available in seconds, or a volunteer workforce that changes every week.
FIDO2 could offer solutions
The frustrating part is that there is a solution, and it is already proven in healthcare, manufacturing and retail. FIDO2 authentication delivered through NFC badge-taps lets a staff member authenticate in under two seconds: tap a badge, enter a short PIN, session opens.
It satisfies the MFA requirement by combining possession of the badge with knowledge of the PIN. It is faster than typing a password. Crucially, it is compliant, because each badge is enrolled as that individual’s unique FIDO2 credential, so the Cyber Essentials requirement for unique user accounts is met. Shared keys or shared PINs would not work. Individual badges do.
Need for better guidance
v3.3 explicitly recognises FIDO2 authenticators and passkeys as valid MFA methods. The compliance path is clear. What is missing is anyone telling the organisations most affected that this path exists.
That is the gap that must close. The NCSC and IASME have made the right policy decision; the scheme would be weaker without it.
But implementation guidance for shared-terminal, shift-based and high-turnover environments is thin, and these organisations are running out of time to find their way through it. Many of them hold Cyber Essentials because it is required for government contracts or in their supply chains; losing certification has a direct commercial cost.
The answer is not to soften the requirement. The answer is to make sure no one fails for lack of information about how to meet it.
Jonathan Krause is Founder and Managing Director of Forensic Control
Over the four-day Easter weekend of 18 to 21 April 2025, customers of British high street fixture Marks & Spencer (M&S) took to social media in droves to lament an apparent outage that was causing disruption to in-store contactless payments.
At first glance, the disruption appeared to be the result of a run-of-the-mill IT glitch that happens from time to time, but by Tuesday 22 April, it was starting to become apparent that something far more sinister was going on. M&S shut down multiple public-facing services, such as online shopping and in-store click and collect, and CEO Stuart Machin made the rounds of the morning news studios to confirm that the retailer had been hit by a cyber attack.
The incident was the first in a series of damaging attacks against UK retailers – all orchestrated in similar fashion via the systems of an unwitting third-party tech supplier – to come to light.
As the likes of Co-op and even Harrods were drawn in, Scattered Spider – the English-speaking hacking collective behind the attack – and associated groups such as Lapsus$ and ShinyHunters became household names.
Over the summer of 2025, the teen hackers turned their attention to other targets, hitting organisations operating in multiple verticals all over the world. The cyber crime spree arguably hit its zenith – or nadir depending on your point of view – with the August 2025 attack on carmaker Jaguar Land Rover (JLR), the repercussions of which continue to reverberate around the UK economy nearly eight months on.
But the chaos kicked off at M&S, with shelves left empty as store managers struggled with downed ordering systems, and homes across the nation going without upmarket picky teas, pig-shaped gummy sweets and caterpillar-themed cakes.
Third-party vulnerabilities: it started with a phone call
“A year on from the M&S attack, the numbers tell a stark story. Retail cyber attacks grew around 34% last year, and the trajectory since then suggests that figure has only climbed further,” says Check Point UK and Ireland head of enterprise, Charlotte Wilson.
“What the incident made clear is how the nature of the attack itself should be understood. The initial entry point at M&S, and at others like Jaguar Land Rover … was a phone call. Someone convinced a helpdesk operative to hand over system access by impersonating an employee. That was the door in, and it opened onto hundreds of millions of pounds of damage. The most expensive cyber attack in British retail history began with a conversation.”
Muhammad Yahya Patel, Huntress virtual chief information security officer (vCISO) and EMEA cyber security adviser, says it is precisely this relatively unsophisticated origin story that marks the M&S breach as a case study that every security team – whether working in retail or not – should have printed out and stuck on the wall.
“The attackers didn’t find a zero-day. They didn’t bypass a next-gen firewall. They picked up the phone, pretended to be an M&S employee and asked a third-party service desk to reset a password. That was it,” says Patel.
“Everything that followed, the Active Directory database exfiltration, the credential cracking, the ransomware deployment across VMware hosts – all of it flowed from lack of service desk processes.
“Perhaps the most sobering detail [is] the four individuals arrested by the NCA in July were aged 17 to 20. These weren’t nation-state actors with deep pockets and government backing. They were young, English speaking and highly effective at finding the gap between an organisation’s technical controls, people and processes.”
The lasting effect on boardroom conversations
But significantly, says Check Point’s Wilson, the M&S attack seems to have served as a much-needed alarm call for the retail industry, and many of her customers have started scrutinising their supply chains as a result.
“The attack exposed a hard truth: your security posture is only as strong as the weakest link in your vendor ecosystem, and for many retailers, that link had never been seriously stress-tested. The supply chain conversations happening in boardrooms today simply weren’t happening 18 months ago,” she says.
“Cyber risk is now seen as a board-level issue in a way it simply wasn’t before. That cultural shift may prove to be the attack’s most important legacy.”
Dominic Mortimer, who leads the red team at Bulletproof from WorkNest, agrees that security leaders seem to be more alert to the dangers of social engineering.
“The M&S breach accounted for a massive and direct uptick in organisations wanting to include similar breach scenarios in their tests,” Mortimer tells Computer Weekly. “I think like 80% of the latest red teams we’ve done following that breach announcement have all included help desk [or] vishing simulation scenarios to ensure the organisation’s resilience and defences extend to these third-party areas.
“It very much shone a light on an area that had previously been neglected by organisations and many reconsidered or approached with greater scrutiny their reliance on outsourced third-party entities. So, it’s very much become a warning tale that organisations have taken to heart, which is a massive positive despite the bad times had by M&S.”
Post-breach lessons
This said, cyber security in retail remains an uphill battle, and Wilson highlights some structural factors that still make shops harder to protect than, for example, financial services companies, or business-to-business publishing houses.
These factors include – but are not limited to – more public-facing contact points that lead to significantly higher volumes of phishing attempts, frequent frontline staff turnover and historically lower average security maturity. This all adds up to a threat environment that is hard to harden. Furthermore, Wilson adds, retailers operate on such tight margins that cyber security faces chronic underinvestment
It is perhaps not much of a surprise then that Check Point’s most recent cyber attack statistics for March 2025 reveal that the consumer goods and services sector was one of the most heavily targeted in the UK.
Huntress’ Patel says he is now seeing a wave of multi-channel approaches by hackers using email, phone calls, SMS and even Microsoft Teams to build trust with employees before delivering the killer blow. This, he says, makes them hard to stop with any single method of control.
“It requires a culture of verification and education, not just a stack of tools,” he says. “The organisations that come out of this period strongest won’t necessarily be the ones who spent the most. They’ll be the ones who were honest about where their real gaps were and closed them.
“At Huntress, we continuously see attackers inside business as we step in to stop them in their tracks. We are witnessing a professionalised scaling of the identity theft ecosystem. Adversarial efficiency is at an all time high. By transforming unauthorised access into reliable, long-term footholds, attackers are treating networks like a marketplace.
Our collective ability to recognise and resist that kind of secondary exploitation simply hasn’t improved. The attackers know it, and they’re counting on it Charlotte Wilson, Check Point
“Organisations must pivot their strategy if you are only watching the ‘break-in’, you are missing the breach. The priority must shift to rigorous, post-authentication visibility and anomaly detection,” he says.
Wilson reflects that the M&S incident seems to have prompted the government to start to act with more urgency. She notes the National Cyber Security Centre (NCSC), in its most recent annual report, says it dealt with 204 “nationally significant” cyber attacks from September 2024 to September 2025, more than doubling the previous record of 89. She also points out the progress made on the Cyber Security and Resilience Bill (CSBR), and Westminster’s Cyber Action Plan and proposed £210m centralised cyber unit.
“We are finally starting to see government not just understand but actively communicate the societal and economic cost of cyber threats. That is progress,” she says. “What hasn’t changed, though, is individual behaviour. Consumers going about their daily lives aren’t taking meaningfully more care with their personal data.
“And there’s a chapter of this story that hasn’t been told nearly loudly enough: the wave of class-action scams that followed the breaches. They’re still out there on social media: deepfake videos asking whether you were affected, whether you might be entitled to compensation, harvesting the details of the very people who were already victims once.
“The original breach made the headlines, but the scams that fed on it didn’t. And from a societal perspective, our collective ability to recognise and resist that kind of secondary exploitation simply hasn’t improved. The attackers know it, and they’re counting on it,” she warns.
Entertainment1 week ago
Tech1 week ago
Tech1 week ago
Fashion1 week ago
Tech1 week ago
Politics6 days ago
Politics6 days ago
Entertainment5 days ago