The Dutch National Cyber Security Centre (NCSC-NL) and cybersecurity company Modat have identified nearly 8,000 physical and virtual solar power assets across Europe that have a publicly-accessible presence on the internet, posing a significant cyber risk to all parties from individual operators to nation states.
The researchers’ finding were presented by Modat’s Soufian El Yadmani and NCSC-NL’s Bouke van Laethem on 6 October at the ONE Conference held at the World Forum in The Hague, and the findings have since been published. The research includes solar and wind projects, and the definition of a solar “system” ranges from individual solar panels to software that controls several devices or an entire solar park, and includes 7,942 systems with public-facing elements that could be vulnerable to cyberattack.
Try Premium for just $1
- Full premium access for the first month at only $1
- Converts to an annual rate after 30 days unless cancelled
- Cancel anytime during the trial period
Premium Benefits
- Expert industry analysis and interviews
- Digital access to PV Tech Power journal
- Exclusive event discounts
Or get the full Premium subscription right away
Or continue reading this article for free
The research authors note the figures presented are “lower bound”: only discovered devices that could be definitely associated with commercial solar plants were included, and that further discovery and attribution would increase the number of systems potentially similarly exposed.
The researchers’ evidence included being able to access web interfaces that allow access to data such as physical location, a device’s current statistics, and web server logfiles. In some cases, they found visitors could control a single or several devices, “or an entire solar park.”
“Physically, wind and sun are the most robust parts of our energy supply. Digitally, they are fragmented, often exposed to the internet and not always monitored. What we can map in hours, an attacker can map in hours too. You can’t defend what you can’t see, and no one can see this whole landscape alone,” said Modat founder and CEO El Yadmani.
The research found that many of the internet-connected assets were misconfigured or un-configured —that is to say left with default settings —by operators. Such configurations expose the software running critical infrastructure to malicious attacks that can be technically trivial to enact.
The report’s authors note that the growing preponderance of cyber defence scanning by dedicated software using large language models means that any exposed assets are increasingly easy for malicious actors to identify and potentially exploit. The report can be read in the context of the European Commission’s Smart Energy Expert Group report published 1 October that contains detailed information on the specific technological and geopolitical risks to solar projects.
Significant risk due to growing European solar deployments
The scale of the risk is significant, considering increasing growth figures in European solar deployment, according to trade body SolarPower Europe. The research notes solar energy comprises 42% of renewable energy generated across the EU, EFTA and EU candidate states, and that 54% of the EU’s total electricity was produced by renewables in Q2 2026.
The Dutch research and identifies Spain and Greece as having the majority of Europe’s solar parks, with 2,766 and 1,860 respectively. It states Italy, Germany, Hungary, Turkey, Belgium, France, Netherlands and Poland have jointly 2,972 solar installations.
The research contains aggregated figures per country on solar and wind power installations only. Names of parks, operators, IP (internet protocol) addresses and locations were not made public. The joint statement published by the NTSC-NL and Modat says affected parties are being informed through their national CERTs.
The research team advises solar operators take a number of actions, including taking admin interfaces off the internet immediately and work under the assumption that facilities have already been breached.
Commenting on the research, Thomas Plank, CEO at OT-specialist cybersecurity company Tributech, said: “Operators should take these interfaces off the public internet today, but that alone won’t solve the problem. Wind and solar parks are unmanned and widely distributed, and they have to stay connected: grid operators, energy traders and maintenance contractors all need remote access to run them. Taking these interfaces offline reduces exposure. It doesn’t change the fact that thousands of remote connections now reach into energy infrastructure.”
