The Dutch National Cyber Security Centre (NCSC-NL) and cybersecurity firm Modat have confirmed that nearly 8,000 physical and virtual photovoltaic (PV) power assets across Europe are publicly accessible via the internet, exposing a wide range of entities—from individual operators to national-level organizations—to significant cybersecurity risks.
Modat’s Soufian El Yadmani and NCSC-NL’s Bouke van Laethem presented these findings on October 6 at the ONE Conference held at the World Forum in The Hague; the corresponding report has now been officially released.
The study covered both PV and wind power projects. The definition of PV "systems" ranged from standalone solar modules to software systems capable of controlling multiple devices or even entire PV power plants; a total of 7,942 systems with public-facing interfaces—making them vulnerable to cyberattacks—were identified.
The authors noted that the figures released represent a "lower bound": the count included only devices clearly linked to commercial PV plants. Further identification and attribution efforts are expected to increase the number of systems found to be at similar risk of exposure.
Empirical evidence gathered by the researchers demonstrated that they could directly access web interfaces to retrieve sensitive information, such as physical device locations, real-time operational data, and web server log files. In some instances, unauthorized users could even control devices—either individually or in batches—or "even entire PV power plants."
El Yadmani, founder and CEO of Modat, stated: "Physically, wind and solar power are the most robust components of our energy supply system. Digitally, however, their system architectures are fragmented; vast numbers of devices are directly exposed to the public internet and generally lack continuous monitoring. The asset mapping we accomplished in a few hours could just as easily be performed by attackers in the same timeframe. You cannot protect assets you cannot see, nor can any single entity grasp the full scope of the risk on its own."
The study found that the exposure of many connected assets stemmed from operator misconfiguration or incomplete setup—specifically, devices retaining their factory default settings. Such configuration vulnerabilities expose the software underpinning critical infrastructure to malicious attacks—attacks that require minimal technical expertise and are easily executed.
The report's authors note the growing prevalence of specialized network defense scanning tools powered by large language models (LLMs); this trend means that assets exposed to the public internet are increasingly likely to be identified and exploited by malicious actors. This report follows a specialized study released on October 1 by the European Commission’s Smart Energy Expert Group, which detailed the specific technical and geopolitical risks facing photovoltaic (PV) projects.
Significant Security Risks Stemming from Europe's Expanding PV Capacity
According to data from the industry association SolarPower Europe, the rapid expansion of installed PV capacity across Europe has brought the associated risks into sharp focus. Research indicates that solar power accounts for 42% of total renewable energy generation across the EU, the European Free Trade Association (EFTA), and EU candidate countries; by the second quarter of 2026, renewable energy sources constituted 54% of the EU's total electricity generation.
The Dutch study reveals that the vast majority of Europe's PV power plants are concentrated in Spain and Greece, with 2,766 and 1,860 exposed assets, respectively. A combined total of 2,972 exposed PV installations were identified across eight other countries: Italy, Germany, Hungary, Turkey, Belgium, France, the Netherlands, and Poland.
The study released only aggregated statistics on installed PV and wind capacity by country; specific details—such as power plant names, operator information, IP addresses, and exact locations—were not disclosed. A joint statement by NCSC-NL and Modat indicated that affected parties are being notified of the risks individually through their respective national Computer Emergency Response Teams (CERTs).
The research team recommends that PV operators immediately implement several protective measures, including taking management interfaces offline from the public internet and adopting a "assume-breach" mindset—preparing for incident response under the assumption that their facilities have already been compromised. Thomas Plank, CEO of Tributech—a cybersecurity firm specializing in Operational Technology (OT)—commented on the study: "Operators should remove these interfaces from the public internet immediately, but that step alone cannot fully resolve the issue.
Wind and solar power plants are largely unmanned and geographically dispersed, yet they must remain connected to the network; grid operators, energy traders, and O&M contractors all require remote access to ensure the equipment functions correctly. Taking these interfaces offline can reduce exposure risks, but it does not alter the fact that thousands of remote connections are now deeply embedded within energy infrastructure."
