A new report identifies 8,547 solar and wind energy systems at risk from cyberattacks in Europe
Of these, 7,942 are linked to solar parks and 605 to wind farms; Spain leads in solar-related exposures
Modat recommends removing administrative interfaces from the public internet among measures to protect the systems from possible cyberattacks
A total of 8,547 internet-facing systems linked to wind farms and solar parks across Europe could be vulnerable to cyberattacks, according to European internet intelligence company Modat. The company claims some exposed assets have publicly accessible administrative interfaces and control panels that should not be reachable from the internet.
In a new report titled To See the Wind and the Sun, Modat claims it has identified confirmed exposures across 35 nations. Jointly prepared by Modat and the Dutch National Cyber Security Centre (NCSC-NL), the report covers the European Union (EU), the European Free Trade Association (EFTA), and EU candidate countries.
After the report's launch, which does not identify operators, vendors, or service providers, Modat says it has received inquiries from operators asking whether their systems are among the findings.
Of the 8,547 identified systems, 7,942 are associated with solar parks across 34 countries, while 605 were linked to wind farms across 23 countries. Spain recorded the highest number of solar-related exposures, at 2,766, followed by Greece with 1,860. Italy and Germany reported 753 and 672, respectively. Together, these four countries accounted for 76% of the identified solar-related systems.
For wind energy, Germany recorded the highest number at 212, followed by Italy with 192, and Türkiye with 84. The Netherlands had 132 exposed solar-related systems and nine associated with wind farms, for a combined total of 141.
Solar is also the most widespread power source in Europe, according to the report that covers operating industrial solar parks from 1 MW to 4 GW. It does not include rooftop solar installations.
Analysts point out, “Taken together, the picture makes it abundantly clear that, physically, decentralised renewable energy is a very hard target. No number of drones, bombs or saboteurs changes that. This is defence by dispersal.”
Modat cautioned that fewer exposed systems do not necessarily indicate lower risk. Some systems can control multiple turbines or an entire wind farm, potentially affecting more generating capacity than a system linked to a single turbine.
According to Modat, an “asset is an internet-facing system that should not be internet-facing, such as an exposed admin interface, and that we have confirmed is related to or used in a solar park or wind farm”.
These systems may include administrative interfaces, monitoring dashboards, and control panels used to manage energy facilities. Modat says it used its Magnify internet intelligence platform and machine-learning techniques to identify and group similar internet-facing systems. Researchers then investigated the results to confirm links to operating wind farms and solar parks.
“Once we started clustering and investigating how much of this infrastructure we could see online, we became deeply worried,” state the analysts.
One example in the report shows an exposed wind turbine interface displaying live power output, wind speed, and other operational data. Its control panel included Start, Stop, and Reset functions. The interface also provided access to a web server associated with a Siemens programmable logic controller (PLC), which manages industrial processes.
A map page revealed the turbine’s physical location, nearby infrastructure, and access roads. The report also identified wind farm login pages that disclosed site names and other identifying details.
These examples, Modat stressed, show how exposed interfaces can reveal operational information and the location of energy assets.
The findings come amid growing European Union concerns about cybersecurity risks associated with connected renewable energy equipment. The EU has restricted the use of its funding for solar PV and battery storage projects involving inverters from high-risk suppliers, while cybersecurity experts have called for stronger safeguards across the solar industry (see EU Experts Urge Tighter Cybersecurity Rules For Solar PV).
Modat analysts recommend that renewable energy operators take quick measures to ensure cybersecurity for their assets. Recommendations include removing administrative interfaces from the public internet, implementing secure connectivity, and building and maintaining visibility of assets, architecture, and access, including everything that suppliers and service providers connect.
The findings come as renewable energy accounts for a significant share of Europe's electricity generation. Eurostat figures cited in the report show that renewables supplied 54% of EU electricity in the second quarter of 2026. Solar accounted for 42% of renewable electricity, followed by wind at 28% and hydropower at 23%.
Earlier this year, the EU launched a roadmap to accelerate the use of AI and digital technologies across the energy sector. It also focuses on reducing cybersecurity risks in critical energy infrastructure, including solar and wind energy (see EU Releases AI Roadmap For Smarter & Safer Energy System).
European solar and storage industry trade association SolarPower Europe had previously launched a report along with DNV, recommending tailored cybersecurity rules for solar systems (see EU Solar PV Industry Calls For Cybersecurity Measures).
