Photovoltaic (PV) safety—a sudden, urgent wake-up call.
8,547 Wind and Solar Systems Left "Exposed"
A report jointly released by the Dutch internet intelligence firm Modat and the National Cyber Security Centre of the Netherlands (NCSC-NL) reveals that across 40 countries—including EU member states, EFTA nations, and EU candidate countries—there are 8,547 systems linked to wind farms and PV power plants that should never have been directly accessible via the internet. These include exposed management interfaces and control panels.
Of these, 7,942 are associated with PV systems. Spain alone accounts for 2,766, by Greece, Italy, and Germany; these four countries together represent 76% of all exposed PV-related systems. A warning from Modat founder Soufian El Yadmani should put the entire industry on high alert: "The map we were able to create in a few hours is one that an attacker could just as easily create in the same amount of time. You cannot protect what you cannot see."
This is no ordinary vulnerability report. It exposes a structural issue: as large-scale PV capacity is deployed, have the security defenses for the power grid kept pace?
Currently, wind and solar assets are the most geographically dispersed energy resources in Europe—making them difficult targets in the physical world. In the digital realm, however, the situation is quite different. To identify these systems, researchers utilized machine learning clustering technology via "Modat Magnify," which automatically groups similar online systems and surfaces device types—a process that attackers could replicate with equal speed.
These findings were released just weeks after a joint statement from various Dutch intelligence and security agencies—including the NCSC, the NCTV, government CIOs, the Public Prosecution Service, and the police—which warned that artificial intelligence is accelerating such threats.
According to the report, one publicly accessible web interface for a wind turbine not only displays real-time power generation data but also provides controls to start, stop, and reset the unit. Another page grants direct access to the web server controlling a wind turbine, with the device's location marked on a map. Some login pages are even labeled with the names of specific wind farms—one of which explicitly indicates that the default username is "root." Modat and NCSC-NL explicitly state that these figures represent only a lower bound; they include only those systems that can be definitively linked to specific power plants. A vast number of systems sharing the same characteristics—but not yet attributed to a specific site—are not accounted for. In simpler terms, these "exposed" (or "unprotected") wind and solar power systems are merely the tip of the iceberg; the actual number is likely even higher.
It is well known that the fundamental difference between photovoltaic (PV) power plants and conventional thermal or nuclear power plants lies in their extreme geographical dispersion. A large-scale ground-mounted PV plant can span several square kilometers and encompass tens of thousands of inverters, data loggers, and communication gateways.
While sabotaging a PV plant physically is often not worth the effort, the situation changes in the digital realm. Due to their fragmented, exposed, and frequently unmonitored nature, these systems are highly vulnerable. An attacker does not need to be physically present on-site; simply locating a login page with an unchanged default password can allow them to escalate access from a single device to the control of an entire power plant—or even multiple plants.
A deeper, more systemic danger lies in the potential for cascading effects across the power grid. By the second quarter of 2026, renewable energy accounted for 54% of the European Union’s electricity, with solar PV alone representing 42% of that renewable generation. With nearly 8,000 PV-related systems accessible via the public internet, the risk extends far beyond asset losses for individual operators. If an attacker were to simultaneously issue shutdown commands to multiple exposed interfaces—or manipulate the active/reactive power setpoints of inverters—the result would not merely be a data breach, but rather synchronized power deficits and voltage fluctuations.
The inherent intermittency of solar power already places strain on grid regulation. If an external attacker were to exploit this intermittency—orchestrating a sudden, concentrated drop in power output at a critical moment—the grid’s frequency regulation and reserve resources would face a challenge far more severe than that posed by natural fluctuations. The potential damage to the power grid is easy to imagine.
Security vulnerabilities in PV systems: A precedent already exists.
The Modat report is not an isolated incident. Cybersecurity issues in photovoltaic (PV) systems are not a new phenomenon.
The first publicly disclosed cyberattack on a PV system occurred in 2019. Attackers repeatedly rebooted communication equipment belonging to the U.S.-based company sPower, causing multiple five-minute communication outages between its control center and a 500 MW wind and solar asset in Utah.
In 2022, Dutch media outlet *Tweakers* reported that a hacker named "Jelle Ursem" breached a PV system. According to *Tweakers*, the hacker was able to access the personal data of Dutch customers, create new user accounts, and delete existing ones. Furthermore, he could determine the power output of customers' solar panels via GPS coordinates, and download, modify, and upload inverter firmware.
The incident in Poland in late 2025 marked an escalation in the severity of such attacks. More than 30 wind and solar power plants were targeted in a coordinated strike; after gaining access to the internal networks of substations, the attackers deployed "wiper" malware to corrupt controller firmware and delete system files. Notably, the inverters themselves remained untouched—the attacks specifically targeted the substation interfaces connecting the power generation facilities to the electrical grid.
These cases point to a reality that the industry has long sidestepped: the core of PV security lies not in the inverters themselves, but in the "connections." Communication layers—such as APIs, MQTT, REST interfaces, and data backhaul channels for mobile applications—are designed to facilitate remote monitoring and operations. However, in the absence of rigorous authentication and network segmentation, these channels often become overlooked vulnerabilities.
The most immediate impact of the Modat report on future PV installations is that cybersecurity will shift from being an "optional feature" to a "prerequisite for grid connection." Previously, cybersecurity during the plant design and EPC (engineering, procurement, and construction) phases was often equated simply with "installing a firewall," while operational security relied on the default configurations provided by manufacturers' cloud platforms. Future trends are clear: the physical or logical isolation of management interfaces from production control networks will become a fundamental requirement. Default factory passwords, unclosed ports, and unauthenticated write interfaces will be included on the "negative list" for grid-connection acceptance. Asset owners and operations/maintenance teams must treat their network exposure surface with the same rigor applied to grid-related protection settings—continuously mapping these exposures and minimizing them.
