Sustainable cyber–physical power systems (CPPSs) significantly reduce carbon emissions due to climate change. However, when the data exchange in CPPSs suffers from hybrid attacks, the distributed state estimation and optimal power flow (OPF) analysis will inevitably be compromised, leading to inadequate or faulty scheduling of clean energy and thermal power generations and further affecting the total carbon emissions and economic cost. To address these problems, this paper proposes a novel consensus-based distributed security state estimation (DSSE) method for CPPSs, which is used to analyze the impact of hybrid attacks on carbon emissions and economic cost. Firstly, the incomplete and non-authentic data features caused by hybrid attacks are described, and their influence on distributed state estimation model is analyzed. A new residual-based attack detection method is then constructed in each subregion, where secure and non-secure sets are employed to describe whether the subregion is attacked and the compensation mechanism is designed for the non-secure set. Secondly, considering data compensation, distributed state estimation model is reconstructed, and a distributed security state estimation method under hybrid attacks is proposed while its convergence condition is derived. Thirdly, the impacts of hybrid attacks on carbon emissions and economic costs are analyzed based on the proposed DSSE method. Finally, experimental results confirm the validity of the theoretic analysis