Why are thousands of European renewable energy control systems still open to the internet?

The short version

• Security researchers Modat and the Dutch National Cyber Security Centre (NCSC-NL) conducted a scan of European renewable energy infrastructure.
• The investigation revealed over 8,500 systems at wind farms and solar parks exposed directly to the internet.
• These systems span thirty-five countries in and around the EU, with significant concentrations in major energy-producing nations.

The details

According to Help Net Security, the joint research by Modat and NCSC-NL identified 8,547 specific internet-facing systems. These assets belong to wind farms and solar parks located across thirty-five countries within and surrounding the European Union. The researchers determined that these systems should not be reachable from the public internet, representing a significant configuration failure by operators.

The exposed systems vary in their functionality and risk profile. Some present simple login screens, which could be targeted for credential brute-forcing. Others expose more dangerous interfaces, such as turbine control pages. According to the report, at least one control page offers a Stop button accessible to anyone with a web browser, potentially allowing remote shutdown of critical energy generation equipment.

The context

Geographic analysis of the exposed systems highlights specific regions of high risk. Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems found during the scan. Security Magazine also reported the discovery of more than 8,500 exposed systems linked to European wind farms and solar parks, corroborating the scale of the issue.

The actual number of vulnerable systems is likely higher than the 8,547 confirmed instances. Many systems may have been obscured by firewalls, changed IPs, or shut down between the initial scan and the publication of the findings. The widespread nature of the exposure suggests systemic issues in how renewable energy infrastructure is configured for network connectivity and security monitoring.

Next steps

Energy operators must immediately audit their network perimeter to identify any unintended internet-facing assets. Security teams should verify that all control systems are properly segmented behind firewalls and require strong authentication. Continuous monitoring is essential to detect new exposures as infrastructure changes or as attackers probe for entry points.

What to do and how to stay safe: Modat

• Review firewall rules to ensure turbine and solar park control systems are not publicly accessible.
• Implement strict access controls and multi-factor authentication for any necessary remote management interfaces.
• Monitor network logs for unusual traffic patterns targeting energy control protocols or administrative ports.
• Conduct regular vulnerability scans of your industrial control network to identify misconfigured or exposed assets.

Step-by-step guide: How Dark Web Monitoring Works: The Hidden Mechanics and Limits

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which countries have the most exposed renewable energy systems?

Operators in Spain, Greece, Italy and Germany account for most of the confirmed systems found by researchers.

What kind of systems were found exposed to the internet?

The exposed systems range from login screens to turbine control pages with remote stop buttons accessible via web browsers.

Who conducted the research on these exposed systems?

The Dutch National Cyber Security Centre (NCSC-NL) and cybersecurity organization Modat discovered the exposed systems.