> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Thousands of wind and solar park systems sit exposed on the internet across Europe
- URL: https://f4n6.co.uk/security-feed/thousands-of-wind-and-solar-park-systems-sit-exposed-on-the-internet-across-europe/
- Published: 2026-10-09T08:09:26.000Z
- Updated: 2026-10-09T08:09:26.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Modat and NCSC-NL, the Dutch national cyber security centre, identified 8,547 internet-facing systems at wind farms and solar parks across 35 countries in and around the EU that should not be reachable from the public internet. The exposed systems include login pages, live telemetry dashboards, and at least one turbine control panel that presents Start, Stop and Reset buttons to any browser that reaches it. Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems, and the researchers state the true figure is higher because a system was only counted once it could be tied to a specific site. No CVE, exploitation campaign or named threat actor is attached to this finding; the risk is standing exposure of operational technology to the public internet, and the researchers' own framing is that decentralised renewables are hard to attack physically but have no equivalent protection in cyberspace. For EMEA financial services the direct exposure is indirect but real: renewable operators are borrowers, insured counterparties and increasingly corporate power purchase agreement (PPA) counterparties, and a forced outage at an exposed site is a credit and contract event before it is a cyber event.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                                                                                                                             | Practical impact                                                                                                                                                                                                                                |
| ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles                  | Financial entities hold PPA, lending or insurance relationships with renewable operators whose OT is internet-facing, and the source describes reliance on dozens of remote links to outside parties per site               | Third-party risk assessment must cover the operational resilience of the counterparty's generation assets, not only their IT. Contractual and monitoring arrangements with energy counterparties fall inside the ICT third-party risk register. |
| NIS2 Art. 21(2)(d): supply chain security measures                      | The exposure sits in the supply chain of energy delivered to, or contracted by, financial entities, and the source notes remote access is granted to multiple outside parties per site                                      | Where a financial entity is in scope for NIS2, supply chain security measures must extend to energy and utility dependencies assessed as critical to service continuity.                                                                        |
| DORA Art. 30: key contractual provisions with ICT third-party providers | Where a financial entity contracts directly with a renewable operator or its service provider for power or for co-located infrastructure, the remote-access arrangements described in the source are contractual provisions | Contract terms should require disclosure of remote-access paths, incident notification timelines, and audit rights over the OT environment supporting the contracted service.                                                                   |

No DORA incident-reporting article is engaged: this item reports discovered exposure, not an incident affecting a financial entity. If a client's own site or a site it depends on is later disrupted, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become live at that point.

## 3\. Technical analysis & attack chain

This is a research finding, not an intrusion. There is no confirmed attack chain, no exploited CVE, and no attributed actor in the source material. What follows is the exposure as documented, and the steps an attacker would take against it are inferred from the described interfaces, not observed.

1. Modat used machine-learning clustering to group similar internet-facing systems automatically, which surfaced device types the team had not previously known to look for. No rule set was written first; the clustering found the devices.
2. A system was added to the count only once the researchers could link it to a specific solar or wind site. This is why the researchers state the real number is higher than 8,547.
3. The identified systems span 35 countries in and around the EU. Solar accounts for 7,942 systems across 34 countries; wind accounts for 605 systems across 23 countries.
4. Solar concentration: Spain 2,766 (35 percent of the solar total), Greece 1,860, Italy 753, Germany 672\. Those four countries hold 76 percent of the solar total.
5. Wind concentration: Germany 212 and Italy 192 make up 67 percent of the wind total. Spain, the solar leader, has 11 wind systems.
6. The exposed interfaces range from login screens to a live turbine control page. One documented turbine dashboard displays live power, wind speed and rotor data, and its control panel offers Start, Stop and Reset buttons to anyone with a browser.
7. A menu item on that same turbine page reaches the web server of the Siemens ET 200SP PLC, the industrial controller running the turbine. The PLC web server is therefore reachable through the same exposed interface as the dashboard.
8. A map page on the turbine interface discloses the turbine's location. Aerial imagery of that location shows the neighbouring turbine, the service buildings and the access road.
9. That page controls one machine. Other systems in the data set sit a level higher and control several turbines or an entire farm, so a single exposed system can represent far more generating capacity than one turbine. The wind farms in scope run from 10 megawatts to more than 4,500 MW.
10. Two wind park login pages named their sites outright. One of them noted that the default username is root in all newer releases.

The wind figure is the smaller of the two and the more consequential per system. A single exposed solar inverter typically represents one asset; a single exposed wind system can represent a farm. The researchers make this point directly, and it should drive triage: 605 wind systems is not 605 turbines.

On vendor origin, Lithuania bars entities from countries it considers national security threats, including China, from remotely controlling solar parks, wind farms and storage above 100 kW. Thomas Plank, CEO of Tributech, told Help Net Security that restricting remote control by high-risk vendors addresses who connects, not what happens once they do, and that most systems in the report are exposed regardless of vendor origin. His position is that a European vendor with a stolen maintenance account gives an attacker the same access, that wind and solar parks rely on dozens of remote links to outside parties, and that some of those links will be compromised. He also states that once an attacker is inside, the network cannot distinguish a legitimate stop command from a malicious one, and that every command reaching a turbine or inverter should be checked for sender identity, authorisation for that specific asset and action, and integrity in transit.

Confidence caveats. The 8,547 figure, the country breakdown, the turbine interface description and the Siemens ET 200SP PLC reference all rest on a single research effort by Modat and NCSC-NL, reported by one outlet. The Plank quotes are a single vendor executive's opinion, not a finding. No CVE, no exploitation activity, no malware and no named threat actor appear anywhere in the source material, and nothing here should be treated as evidence of an active campaign. The source does not state which specific turbine or PLC firmware versions are affected, does not name the operators, and does not provide the affected IP ranges.

## 4\. Mitigation & containment

The source names no vendor fix, no patch and no CVE, so the actions below are exposure-reduction measures against the interfaces described, not remediation of a specific vulnerability.

P1 (within 24 hours)

- If your organisation operates or co-owns renewable generation, enumerate every internet-facing interface on those sites and confirm whether any presents control functions (Start, Stop, Reset) or a route to a PLC web server. The Siemens ET 200SP PLC web server is the specific case documented; treat any reachable PLC web interface as P1.
- Remove public reachability from turbine and inverter control interfaces. Where remote access is contractually required, terminate it behind a VPN or zero-trust broker with per-asset and per-action authorisation, not a public login page.
- Change default credentials on any exposed interface. The source documents a wind park login page stating the default username is root in all newer releases; assume default or shared credentials on any system you have not personally verified.
- Notify your energy counterparties and, where you are the operator, your NCSC or national competent authority. In the Netherlands that is NCSC-NL, which co-produced the research.

P2 (within 72 hours)

- For any site you depend on but do not operate, request written confirmation from the counterparty that public exposure has been removed and that default credentials are not in use. Treat non-response as an open risk item in the third-party register.
- Inventory the remote links each site maintains to outside parties. The source states sites rely on dozens of such links; each one is an access path that survives perimeter hardening.
- Review whether any exposed interface discloses site location through map pages or embedded imagery, as the documented turbine page does. Location disclosure plus control access is a physical security problem as well as a cyber one.

P3 (within 7 days)

- Implement command authorisation and integrity checking on turbine and inverter control paths, per Plank's recommendation: verify who sent each command, whether that sender is authorised for that specific asset and action, and whether the command arrived unchanged.
- Add the exposed interfaces to continuous external attack surface monitoring so that re-exposure is detected rather than discovered by a third party.
- Where you hold insurance or credit exposure to renewable operators, add OT internet exposure to the counterparty risk questionnaire and record the answer.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The source provides no hashes, domains, IP addresses, file paths or command lines. It describes exposed interfaces and a research methodology, not an intrusion.

Behavioural indicators

| behaviour                                                                                                           | where to observe                                          | confidence                                                                     |
| ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------ |
| Turbine or inverter control interface reachable from the public internet, presenting Start, Stop or Reset functions | External attack surface scan; site network perimeter logs | Confirmed in source for one documented turbine; general pattern single-sourced |
| PLC web server (Siemens ET 200SP) reachable through the same exposed interface as the operator dashboard            | Site network; PLC management interface access logs        | Single-sourced                                                                 |
| Login page stating default username root in newer releases                                                          | Interface banner or login page text; credential audit     | Single-sourced                                                                 |
| Map page or embedded imagery disclosing site location and surrounding infrastructure                                | Interface content review                                  | Single-sourced                                                                 |
| Multiple remote access links from third parties into the site network                                               | Firewall, VPN and remote access logs                      | Single-sourced (vendor executive statement)                                    |

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no malware artefacts, no command-line strings, no file names, no registry keys, no scheduled-task names and no network indicators. The only named technical component is the Siemens ET 200SP PLC web server, which is a legitimate product name and not a threat artefact; a rule matching it would detect reporting about this finding, not malicious activity.

Detection effort should instead go to external attack surface monitoring for the interface types described in §5, and to authentication and command logging on any turbine or inverter control path that remains remotely reachable.

## 7\. Sources

- Help Net Security, "Thousands of wind and solar park systems sit exposed on the internet across Europe", https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/, 2026-10-09\. Single source for all figures, the turbine interface description and the Plank quotes. Underlying research by Modat and NCSC-NL.

## 8\. Adverse Trace position

We assess this as a standing exposure finding rather than an incident, and we are not inflating it into one: there is no CVE, no exploitation activity and no attributed actor in the source material, and the 8,547 figure is single-sourced to one research effort by Modat and NCSC-NL. The material risk to EMEA financial services is counterparty and continuity risk, not direct compromise. Renewable operators are borrowers, insured parties and PPA counterparties, and a forced outage at a site whose turbine control panel is reachable from a browser is a contract and credit event that arrives through the cyber route. The wind subset deserves disproportionate attention: 605 systems, but each can control a farm running from 10 MW to more than 4,500 MW. We will track whether NCSC-NL or Modat publish the affected IP ranges or operator list, and we will issue a follow-up if any of the exposed interfaces are linked to an intrusion. Clients with renewable exposure in Spain, Greece, Italy or Germany should treat the P2 counterparty confirmation requests in §4 as the priority action this week.

---

[Read the original source →](https://www.helpnetsecurity.com/2026/10/09/eu-renewable-energy-cybersecurity/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*