The fence does not stop whoever arrives over the internet: 8,547 exposed systems at European wind and solar parks
A site can be surrounded by a fence, cameras, access control and an intrusion detection system. But if the control interface of its technology can also be reached from the internet, an attacker does not have to get anywhere near the gate.
Research by the Dutch internet intelligence company Modat and the Dutch National Cyber Security Centre (NCSC-NL) identified 8,547 internet-facing systems at European wind farms and solar parks. The researchers mapped the parks of 40 European countries and found exposed systems in 35 of them.
What did the researchers find?
- 7,942 solar and 605 wind systems. The solar systems appeared in 34 countries and the wind systems in 23; Spain had the most solar systems (2,766) and Germany the most wind systems (212). According to the researchers the real figure may be higher, because only systems that could be tied to a specific site were counted.
- Not just information pages. In one published example, the web interface of a single wind turbine showed live production data, the location of the equipment on a map, and Start, Stop and Reset buttons. Other systems control several turbines or an entire farm.
- Telling login pages. Two wind-park login pages named the park they belonged to, and one of them noted that the default username is root in the newer releases.
- 181 sites. According to Security Magazine’s summary, the researchers estimated that at 181 sites full operational control may have been possible. This is an estimate; Modat’s own summary does not give the figure.
An important clarification: exposure, not a proven attack
Being reachable from the internet does not automatically mean that all 8,547 systems could be taken over without a password. It does mean that these systems can be discovered from the outside and may be open to attack. Even a publicly reachable login page, an identifiable manufacturer or a default username can give an attacker valuable information.
So the research revealed exposure, not a proven cyberattack. The published data are only per-country totals: the names, operators and locations of the parks were withheld, and the affected parties were notified through the national CERTs. The lesson for security engineering is serious all the same.
Where distance no longer protects
Wind and solar parks are geographically scattered, often remote facilities that run without permanent staff. Physically, this decentralisation may actually increase their resilience: it is hard to attack many sites at once. Digitally, however, distance is no protection any more: every control interface reachable from the internet can end up just as “close” to an attacker.
The stakes are not small either: in the second quarter of 2026, renewables generated 54 per cent of the EU’s electricity (Modat’s figure).
What could the consequences be?
A fence, video surveillance, access control and an intrusion detection system are of little use if the digital path to the technology controls is not properly secured. The consequence of a successful intervention would not be just data loss, but could include:
- lost production or an outage,
- incorrect configuration of the equipment,
- the risk of physical damage or faster wear,
- false alarms and unnecessary callouts to the site,
- a dangerous situation for maintenance staff and operators.
One expert quoted by Security Magazine warns that tampering with configurations could lead to overloads and lasting damage.
One risk picture: IT, OT and physical protection
This shows that IT, OT and physical security cannot be treated as separate fields. Protection has to see the control systems, the cameras, access control, the communication links and the suppliers’ remote access in the same risk picture. My earlier article on the convergence of cyber and physical security made the same point, and it applies to the cameras on site as well: a camera is a computer too.
The most important steps
- Inventory: map all assets and all access, including every remote connection and what it can change;
- Remove public interfaces: take administration and control interfaces off the internet; according to the researchers this is the operators’ first step;
- Secure remote access: access only through a VPN or a secure gateway, multi-factor authentication and regularly rotated credentials;
- Segmentation: proper separation of the IT, OT and security-system networks;
- Supplier access: regular review, individual supplier accounts with strong authentication and no shared passwords, and monitoring rights kept apart from command rights;
- Logging: the operator’s own log of the commands issued and configuration changes, so that it does not have to rely on the vendor’s systems alone;
- Practice: joint incident response exercises and a tried manual operating mode; where the organisation falls under NIS2, meeting the 24-hour early warning also needs rehearsing.
Conclusion
The protection of critical infrastructure no longer ends at the site fence. Physical and digital protection can create real operational resilience only together.
The decisive question is not how high the fence is, but who can reach the controller from the internet.
Sources: Security Magazine: 8,500 European wind, solar systems exposed; Modat: To See the Wind and the Sun; Help Net Security (October 6–9, 2026)
Questions, or an idea to talk through?
Whether it is a security system, the IT network behind it or just a thought on this article, I am happy to hear from you.
Get in touch
