Researchers have found 8,547 industrial control systems managing solar and wind installations across Europe exposed and accessible on the public internet \u2014 where they have no business being. The joint investigation by security firm Modat and the Netherlands National Cybersecurity Centre identified the affected interfaces, many protected by nothing more than a basic login page.<\/p>\n
Solar installations account for the vast majority of the exposure: 7,942 of the 8,547 systems. Spain tops the geographic breakdown with 2,766 objects \u2014 35 percent of the European total \u2014 followed by Greece at 1,860, Italy at 753, and Germany at 672.<\/p>\n
The danger is not hypothetical. In December 2025, at least 30 Polish wind and solar farms were attacked through open firewalls that lacked multi-factor authentication; CERT Polska attributed those incidents to a group linked to Russia’s FSB.<\/p>\n
Researchers grouped the critical risks into three categories: exposed controller web servers that could allow attackers to remotely halt or reset equipment; control panels reachable through default credentials \u2014 including at least one documented case of a default “root” login \u2014 and AI-assisted tools capable of automatically scanning microinverters for vulnerabilities, enabling attacks to scale fast.<\/p>\n
Experts stress that adversaries can map vulnerable networks just as quickly as the researchers themselves did. Operators are urged to isolate administrative panels from the public internet without delay.<\/p>\n