With increasing installations of grid-connected power electronic converters in the distribution network, there is a new trend of using distributed control in a cyber layer to coordinate the operations of these power converters for improving power system stability. However, cyber-attacks remain a threat to such distributed control. This paper addresses the cyber-attack detection and a countermeasure of distributed electric springs (ESs) that have emerged as a fast demand-response technology. A fully distributed model-based architecture for cyber-attack detection in the communication network is developed. Based on a dynamic model of ES with consensus control, a local state estimator is proposed and practically implemented to monitor the system. The estimator is fully distributed because only local and neighboring information is necessary. A countermeasure for the distributed ESs to ride through the cyber-attack and maintain regulatory services in a microgrid is demonstrated successfully. Experimental results are provided to verify the effectiveness of the proposed cyber-attack detection method and its ride-through capability.