Researchers say thousands of European wind and solar systems are exposed online

Researchers say they found 8,547 internet-facing systems linked to wind and solar sites across 35 European countries, including interfaces that can display operational data and controls. They told Reuters that they believed full control may have been possible at around 181 sites, putting a concrete security question to operators of critical energy infrastructure.

Watch Desk analysis

What happened

Reuters reports that Dutch researchers Soufian El Yadmani, of internet-scanning company Modat, and Bouke van Laethem, of the Dutch National Cyber Security Centre, presented the findings at the ONE Conference in The Hague on 6 October. They used machine learning to sort and group the data they identified.

The researchers linked 7,942 systems to solar parks and 605 to wind farms. Most were administrative pages with login screens. Some interfaces showed operational data and controls, and some systems covered multiple turbines or an entire farm. The researchers urged operators to take administrative interfaces off the internet. Read Reuters’ report.

Why it matters

An exposed login page is not, by itself, proof that an attacker can get in. But interfaces connected to controls for turbines or solar sites make the researchers’ warning consequential: they say full control may have been possible in a subset of cases. The scale they report also puts the work of finding and securing exposed systems firmly on operators’ to-do lists.

Reuters says the researchers noted that their country rankings partly reflect where they could link systems to specific sites. The reported totals should not be read as a complete census of Europe’s renewable infrastructure, or as evidence that every identified system was compromised.

Our read

This is a significant, specifically described security finding about the computing systems supporting renewable energy, not a claim that Europe’s power supply is under attack. The immediate advice from the researchers is plain: keep administrative interfaces off the public internet. Operators should establish which systems are exposed and secure them, while readers should keep the crucial distinction between exposure and evidence of compromise.

What to watch

• Whether operators take exposed administrative interfaces offline or put them behind stronger access controls.
• Whether further details clarify the systems the researchers believe could be fully controlled.
• Whether relevant national authorities or the EU Agency for Cybersecurity respond to the findings.
• Whether operators disclose remediation or any confirmed incidents.

Discussion spark: When researchers identify internet-exposed controls at critical infrastructure sites, should operators be expected to disclose what they have fixed, or could that disclosure create more risk?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.