Thousands of European wind and solar systems exposed to potential cyberattacks
The sun may be shining, but a storm is brewing.
Wind farm face the risk of cyberattacks. Imahge by Shutterstock.
Follow us
- Researchers found 8,547 publicly accessible solar and wind management systems across 35 countries.
- Spain had the most exposed solar parks, while Germany and Italy led exposed wind farm systems.
- At 181 locations, researchers could fully control systems, including shutting down turbines or entire wind farms.
- Affected administrators have been warned to take exposed systems offline to reduce cyberattack risks.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Researchers have identified 8,547 management interfaces and control panels across 35 countries that are accessible via public internet connections, making them vulnerable to cyberattacks.
Researchers from internet intelligence company Modat have mapped solar parks and wind farms in 40 countries in the EU, the European Free Trade Association (EFTA), and EU candidate states.
The study showed that 7,942 solar systems in 34 countries were exposed to potential unauthorized access. Spain alone accounts for 2,766 exposed solar parks, or 35% of all exposures. Together with Germany, Greece, and Italy, the top 4 countries account for 76% of the total.
Focusing on wind farms, the analysts found a total of 605 exposed systems in 23 countries, with Germany and Italy together accounting for 67%.
The Netherlands accounted for 132 exposed systems in solar parks and 9 in wind farms.
In most cases, the management interfaces and control panels were secured with a login screen. At 181 locations, the researchers had complete control over the systems, allowing them, for example, to shut down wind turbines or an entire wind farm with the push of a button.
Furthermore, once the researchers had access to the control systems, they could view live production data and the turbine’s location.
The researchers say they located the publicly accessible management systems within a few hours.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
“Physically, wind and sun are the most robust parts of our energy supply. Digitally, they are fragmented, often exposed to the internet and not always monitored. What we can map in hours, an attacker can map in hours too. You can’t defend what you can’t see, and no one can see this whole landscape alone,” said Soufian El Yadmani, founder and CEO of Modat.
Administrators of the affected interfaces have been notified and urged to take their systems offline as soon as possible to make sure they don’t become the target for a cyberattack.
The findings of the study were presented on the main stage of The ONE Conference at the World Forum in The Hague earlier this week.
It’s not the first time weaknesses have been detected in renewable energy products. In July, the Chaos Computer Club (CCC) and a security researcher found “devastating security vulnerabilities” in inverters for balcony and roof solar systems from the Chinese company Hoymiles.
