Researchers from the Dutch National Cyber Security Center (NCSC-NL) and the internet intelligence firm Modat identified 8,547 internet-exposed systems connected to wind and solar power facilities in Europe. The researchers surveyed operational renewable energy facilities in 40 countries, including EU and EFTA member states as well as EU candidate countries, and found management and operational systems in 35 of those countries that should not have been directly connected to the public internet.
The important thing is that this doesn't mean all 8,547 of them have already been hacked. Most of them were management systems with login screens exposed, and the research team determined that on approximately 181 sites, it was possible for external parties to take complete control of operations. Some screens even displayed functions that allowed users to start, stop, and reset wind turbines.
| What the study found was an “operating system exposed to the Internet.”
This study was conducted by scanning the entire Internet and clustering the data to identify management systems linked to specific solar and wind power facilities. The research team stated that they included only those cases where the location and operating facility were reliably linked in their count. Therefore, the figure of 8,547 represents the verifiable minimum rather than the final total.
Also, this number doesn't refer to the number of generators or solar panels. A single monitoring system can manage multiple wind turbines or an entire wind farm. Therefore, it is not accurate to simply say that “8,547 power plants were compromised.” The correct explanation is that 8,547 management and operation interfaces accessible via the internet were identified as being linked to specific renewable energy facilities.
| A total of 7,942 solar power systems and 605 wind power systems were identified.
Among the systems connected to specific facilities, the research team found 7,942 solar-related systems and 605 wind-related systems. Solar systems were found in 34 countries, while wind systems were found in 23 countries; overall, exposure was confirmed in 35 European countries. These figures likely reflect the decentralized nature of solar installations and the prevalence of remote management equipment.
By country, Spain had the most exposed solar power systems, with 2,766, followed by Greece with 1,860. In Germany, 672 solar power systems and 212 wind turbines were identified, while Italy followed with 192 wind turbines. However, the research team explained that the country rankings do not reflect the overall level of security and are influenced by the scope of data that could be linked to specific facilities.
| It has been suggested that the 181 most dangerous drugs could be brought under complete control
While most of the vulnerabilities were found on login pages or administrative interfaces, the researchers determined that they could have gained full operational control over approximately 181 sites. According to Reuters, the web page for one wind turbine displayed real-time data along with Start, Stop, and Reset functions, and location information was also exposed. Some systems controlled multiple turbines or entire wind farms.
If such features are accessible from outside the network without authentication or with weak security measures, they could go beyond mere data exposure and impact physical operations. Shutting down power generation facilities or restarting them at the wrong time can affect not only power production but also equipment safety, so the risk can be much higher than that posed by a typical website breach.
| That doesn't mean an actual attack has been confirmed.
This announcement is not an incident report stating that an attacker compromised 8,547 systems. It is a study in which researchers assessed the potential for risk by examining the attack surface accessible via the Internet. The researchers’ analysis also indicates that full control may have been possible on approximately 181 sites; however, no evidence has been disclosed to suggest that malicious attackers actually exploited this vulnerability.
This distinction is important. While internet exposure itself is a security issue that requires immediate correction, the levels of response and liability differ between an “actual breach” and a “potential breach.” Administrators must first block any externally exposed management interfaces and review authentication and remote access configurations; at the same time, they must review logs to separately investigate whether any unauthorized access has already occurred.
| The decentralized nature of renewable energy can be a vulnerability in cyberspace
Wind and solar power plants are distributed across wide areas, which means it is physically difficult to paralyze the entire system with a single attack. However, when internet-connected equipment is used for remote monitoring and control, distance becomes irrelevant in cyberspace. Attackers can target similar equipment in multiple regions simultaneously without having to go to the site.
The researchers warned that attackers, just like defenders, can identify exposed systems on a large scale within a matter of hours. In particular, if equipment from the same manufacturer or default settings are used repeatedly across multiple power generation facilities, a single vulnerability or incorrect configuration could affect multiple countries simultaneously. This is why securing distributed energy infrastructure requires looking not only at individual power plants but also at the entire supply chain and equipment ecosystem.
| AI and automation can further accelerate the speed of attack surface discovery
The research team used machine learning to classify internet scan data and link it to actual power generation facilities. While this automation helps defenders quickly identify exposed assets, attackers can also use similar techniques. When AI organizes and prioritizes the results of large-scale scans, even attackers with limited expertise can identify dangerous administrative interfaces more quickly.
That's why it's important to go beyond simply strengthening passwords and remove the management interface from the public Internet. If remote management is necessary, you should implement controls such as VPNs, private networks, multi-factor authentication, and access allowlists, and separate operational technology (OT) networks from general IT networks. Reducing exposure itself is the most basic defense in the era of automated attacks.
| The research team is sharing information with operators and the national CERT, so
In its research findings, Modat did not disclose specific identifying information such as the names of power plants, operators, IP addresses, or exact locations. Instead, it notified potentially affected organizations through their national CERTs and stated that it would share additional data with operators, equipment manufacturers, service providers, and national CSIRTs to support remediation efforts.
This responsible approach to disclosure is essential in critical infrastructure research. This is because publishing a list of vulnerable systems as-is could provide attackers with specific targets. Conversely, disclosing only country-level aggregates allows us to highlight the scale of the problem while reducing the immediate risk to individual facilities. Going forward, the number of systems that are actually removed from the internet will be a key performance indicator.
| OT security standards must keep pace with the expansion of renewable energy
Europe is rapidly increasing the share of wind and solar power, and as power generation facilities become more decentralized, the number of remotely managed devices is also growing. This study demonstrates that the energy transition is not just a matter of expanding power generation capacity, but also involves the challenge of managing the security of numerous digital control devices. In particular, it is difficult to apply consistent security policies when older equipment or systems from different installers are mixed together.
Going forward, we need to determine how quickly the 8,547 vulnerable systems will be patched and what minimum security standards regulatory agencies in each country require for remotely managed devices. It is also important to determine whether the potential for control over approximately 181 sites is mitigated through actual vulnerability patches and network blocking. As the expansion of renewable energy infrastructure continues, “making things invisible on the grid” will itself become a fundamental requirement for grid resilience.
Tags
#NCSC #Modat #Renewable Energy #Wind Power #Solar Power #Cybersecurity #OT Security #Critical Infrastructure #Power Grid Security #Industrial Control Systems #ICS Security #EuropeanEnergy
