A SEEG report identifies three major cybersecurity risks to solar PV installations in the EU
It recommends stronger controls on inverter communications and firmware updates, along with restrictions on suppliers identified as posing significant cybersecurity risks
It highlights gaps in existing EU cybersecurity rules and says existing rules may not be sufficient
The rapid expansion of solar power in Europe is creating new cybersecurity challenges for the electricity system, according to a new report by the Smart Energy Expert Group’s (SEEG) Working Group on Cybersecurity. It warns that malicious attacks on connected solar PV installations could disrupt electricity supply, overload grid infrastructure, and cause voltage disturbances.
The report, Recommendations to Address Cybersecurity Risk in Photovoltaic Generation, assesses cyberattack scenarios across residential, commercial, industrial, and utility-scale solar installations.
Citing SolarPower Europe’s EU Solar Market Outlook 2025-2030, the SEEG report notes that EU solar PV capacity increased from 86 GW in 2015 to 406 GW in 2025, and is projected to reach 718 GW DC by 2030. As more installations connect to the internet and use remote monitoring and control platforms, a successful cyberattack could affect multiple systems simultaneously.
An EU decision to block funding for solar PV and battery storage projects using inverters from high-risk countries has created uncertainty in the industry. SolarPower Europe had earlier called for clarity in the absence of any written guidance from the European Commission (see SolarPower Europe Seeks Clarity On EU Inverter Funding Ban).
Recently, the EU clarified that its official guidance on the use of EU funds for clean energy projects involving certain inverters is "country neutral" and that it will engage with China in further discussions on this issue.
Meanwhile, the SEEG assessment identifies three high-risk scenarios. The first involves attacks on manufacturer platforms connected to PV installations, particularly residential, commercial, and industrial systems. These platforms allow users to monitor generation, change inverter settings, and update firmware. A security breach could give attackers access to large numbers of connected inverters through a single platform.
The second concerns the deliberate introduction of backdoors by manufacturers acting on behalf of a nation-state actor. Such access could be embedded in a manufacturer's central platform, inverter firmware, or hardware. The report considers this risk relevant across all installation categories examined.
The third involves attacks on utility-scale solar installations through local networks. In this scenario, an attacker gains access to a remote-access firewall and exploits the network used to operate or maintain the installation.
The report warns that attackers who gain control over sufficient solar generation capacity could switch installations on or off, creating imbalances between electricity supply and demand. Other possible consequences include grid congestion and voltage problems. In severe cases, these disruptions could lead to power outages.
According to SEEG analysis, says cybersecurity concerns have intensified following research in 2024 and 2025 that exposed serious vulnerabilities in solar inverters and connected manufacturer platforms. Rising geopolitical tensions and Europe’s dependence on Chinese PV equipment have added to concerns about potential cyberattacks by state-linked groups.
To address the identified risks, the experts recommend requiring manufacturers of internet-connected devices used in PV installations to establish robust vulnerability handling processes for their cloud platforms. These should include clear, enforceable deadlines for fixing security flaws. The report also recommends encouraging “bug bounty” programs to support independent security research.
For utility-scale installations, the report calls for systematic control of internet communications from inverters. All traffic should be documented, encrypted, and authenticated. Outbound connections should be restricted to approved servers located within the EU or under equivalent jurisdictions. Incoming communications from outside the local network should not be permitted.
The report also recommends restricting the use of components and software from suppliers subject to the jurisdiction of third countries identified as posing significant cybersecurity risks. Such restrictions should be based on a thorough risk assessment, the report says, because they could disrupt the market if alternative supplies are insufficient.
For commercial, industrial, and utility-scale installations, SEEG recommends replacing manufacturer-triggered automatic firmware updates with controlled manual updates carried out by qualified maintenance providers. Firmware could also be tested for backdoors, particularly when deployed in critical infrastructure.
For smaller residential systems, the report emphasizes secure design and default settings, timely security updates, and improved vulnerability management. It also recommends cybersecurity training for installers and maintenance providers, along with better protection for the computer systems and credentials they use to access inverters.
The report also assessed four existing EU legal frameworks—the Cyber Resilience Act (CRA), the NIS2 Directive, the Network Code on Cybersecurity (NCCS), and the Network Code on Requirements for Generators (RfG)—to ascertain how well existing legislation can be used to enforce mitigating measures.
It found that while the CRA covers inverters across the installation categories examined by SEEG, but does not provide sufficiently strong verification to enforce the recommended safeguards. Inverters are not currently classified as important or critical products under the CRA, allowing manufacturers to demonstrate compliance through internal assessments without independent testing or audits.
To address this gap, the experts recommend developing a harmonized EU cybersecurity standard for PV inverters and classifying them as Class II important products under the CRA.
The report also recommends aligning thresholds under the NIS2 Directive and the NCCS to make the rules easier for national authorities to apply. It calls for better coverage of PV installers under NIS2 and cybersecurity qualification requirements for installers under the RfG.
The experts further recommend using the proposed revised Cybersecurity Act and the Industrial Accelerator Act to address supply-chain risks, including the possibility of intentional backdoors. They argue that restrictions on high-risk suppliers should also cover residential installations, including plug-in solar equipment.
SEEG analysts also call for incorporating PV cyberattack scenarios into electricity-system risk assessments, including those conducted under the EU Risk Preparedness Regulation and the System Operation Guideline.
The complete report is available for free download on the European Commission’s website.
The SEEG report follows EU solar industry demand for industry-specific cybersecurity controls. A SolarPower Europe commissioned DNV report from April 2025 called for mandatory regulations to limit remote access and control of the bloc’s solar PV systems via the inverter, following the April 2025 power outage in Spain and Portugal (see EU Solar PV Industry Calls For Cybersecurity Measures).
A Loom report, earlier this year, said that Europe remains dangerously dependent on Chinese low-carbon technologies while calling for a coordinated industrial strategy to reduce its dependence on China lest it is forced to do so under pressure from the US (see Europe’s Dangerous Dependence On Chinese Clean Technology).
