Researchers find 8,547 internet-exposed systems at European wind and solar sites

The scan found exposed interfaces across 35 countries

Dutch cybersecurity company Modat and the Netherlands' National Cyber Security Centre said they identified 8,547 internet-facing systems linked to specific renewable-energy sites in 35 European countries: 7,942 associated with solar facilities and 605 with wind facilities. Reuters reported that the researchers estimated systems at about 181 sites could offer full remote control, rather than only an exposed login or monitoring page. [1][3][2]

The country counts reflect what the researchers could attribute, not the number of turbines, panels or power plants. Reuters reported 2,766 solar-linked systems in Spain and 1,860 in Greece; Germany had 672 solar-linked and 212 wind-linked systems, while Italy had 192 wind-linked systems. The team describes its map as a lower bound because some exposed equipment could not be tied to a named site. [3][1]

Exposure is a security weakness, not proof of compromise

An internet-reachable administrative or control interface can give an attacker a path to probe, manipulate or disable equipment if authentication and network defenses fail. It does not show that any listed system was breached. The researchers did not publish site names, addresses or network identifiers and said affected parties were notified through national computer-emergency-response teams. [1][3]

The study matters because small, distributed energy systems can create a wider grid risk when many devices are reachable at once. Reuters linked the concern to a Polish investigation of a December 2025 incident affecting about 30 renewable sites. That earlier incident provides context; it does not establish that the newly mapped European systems were attacked or that they share the same weakness. [3]

Dutch reporting adds local scale and a practical response

Computable, reporting in Dutch, said the dataset included 132 solar-linked and nine wind-linked systems in the Netherlands. This English summary translates the outlet's count and its distinction between ordinary exposed interfaces and systems believed to allow control. The Dutch Inspectorate for Digital Infrastructure advises operators to avoid unnecessary public exposure and to use secure remote-access methods where connectivity is required. [4][1]

Operators, grid managers and national incident-response teams now have to determine whether the identified systems remain reachable, whether credentials or software were weak, and whether equipment can be segmented without disrupting generation. Reuters said authorities in Germany, Italy and Spain and the EU cybersecurity agency did not immediately comment, leaving the remediation status incomplete at publication. [3][4]

How the sources compare