Cybersecurity intelligence company Modat has identified 8,547 internet-facing systems linked to solar parks and wind farms across 35 European countries, raising concerns over potential cyberattacks on renewable energy infrastructure.

The findings highlight cybersecurity risks associated with internet-connected systems used to monitor, manage, and control solar and wind projects.

The identified renewable energy projects were located across the European Union (EU), European Free Trade Association countries, and EU candidate countries. Modat said the actual number could be higher because researchers counted only systems they could clearly link to specific solar or wind projects.

The findings are part of research conducted jointly by Modat and the Netherlands’ National Cyber Security Centre.

Modat recommended that renewable energy companies prioritize cybersecurity at the executive level, strengthen software patch management, reduce potential attack surfaces, and improve logging and monitoring across information technology and operational technology systems.

Cybersecurity Risks

Modat said internet-connected systems could allow unauthorized access to renewable energy infrastructure and expose operational functions to cyber threats.

The risks are significant when exposed interfaces provide access to equipment controls. A successful cyberattack could disrupt electricity generation by targeting individual turbines, multiple turbines, or entire renewable energy projects.

The number of exposed systems does not directly correspond to the number or capacity of generating assets. One system could control a single turbine, several turbines, or an entire solar or wind project.

Modat warned that increasing digitalization and connectivity could expose renewable energy assets to more cyber threats and potentially weaken the resilience of distributed renewable energy infrastructure.

AI-Enabled Cyber Threats

Modat said growing geopolitical tensions, increasing interdependence across energy systems, and advances in artificial intelligence (AI) could heighten cybersecurity risks for renewable energy infrastructure.

While AI can help cybersecurity teams identify and map exposed systems, it can also help attackers identify targets and plan coordinated attacks more efficiently.

Solar Asset Exposure

Of the 8,547 identified systems, 7,942 were associated with solar projects across 34 countries.

Spain had the most exposed solar systems, with 2,766, or approximately 35% of the total. Greece followed with 1,860, Italy with 753, and Germany with 672. Together, the four countries accounted for 76% of the identified solar systems.

 

Wind Asset Exposure

Modat identified 605 internet-facing systems associated with wind projects across 23 countries. Germany had the most, with 212, followed by Italy with 192 and Turkey with 84. Germany and Italy together accounted for approximately 67% of the identified wind systems.

The analysis covered industrial wind farms ranging from 10 MW to more than 4,500 MW and solar projects ranging from 1 MW to 4,000 MW. Rooftop solar installations were excluded.

Cybersecurity Recommendations

Modat recommended removing administrative interfaces from the public internet and using secure connections for operational technology systems.

It advised renewable energy operators to prepare for manual operations where necessary and adapt procedures to changing cybersecurity threat levels.

The report called for cooperation among renewable energy operators, equipment manufacturers, suppliers, and service providers to improve visibility into connected assets, system architecture, and access controls, and to exchange cybersecurity intelligence.

In November 2025, more than 30 members of the European Parliament urged the European Commission to restrict access by Chinese inverters to Europe’s electricity grid, citing cybersecurity concerns associated with high-risk vendors. They noted that 80% of new solar inverter capacity installed in Europe in 2024 originated from China.

In July this year, the U.S. Federal Communications Commission added grid-connected power inverters manufactured in foreign countries to its Covered List, preventing new models from receiving the equipment authorization generally required for their import, marketing, and sale in the country. The decision follows a national security assessment which concluded that foreign-produced connected power inverters could create supply chain vulnerabilities that could expose critical infrastructure to cybersecurity risks

India has also introduced cybersecurity requirements for renewable energy equipment. The Ministry of New and Renewable Energy directed original equipment manufacturers listed under the Approved List of Models and Manufacturers for wind turbines to submit their cybersecurity compliance status by August 31, 2026.