There are 8,547 internet-facing systems across European solar parks and wind farms that should not be reachable from the internet, which means they are vulnerable to cyberattacks, according to research conducted by Modat.
The report by the Hague-based internet intelligence company Modat sparked strong interest from power plant operators, with the firm announcing it will respond to any operator inquiring if its assets are on the list.
“Many operators have asked us whether their own systems are among the findings. This is exactly the right question, and we want to make sure that every operator who asks gets an answer,” the company said, and invited them to get in touch with its team.
The researchers analyzed operating wind farms and solar parks in 40 countries
When presenting the research, Modat announced that it contained only the aggregated figures for individual countries. Names of plants, operators, IP addresses and locations are not public. Affected parties are being informed through their national computer emergency response teams (CERTs), the firm added.
The researchers mapped operating wind farms and solar parks in 40 EU, EFTA and EU candidate countries, and found exposed systems in 35 of them, according to the firm.
Modat founder and CEO Soufian El Yadmani presented the research at the ONE Conference in The Hague.
The researchers would add a system to the list only if they could confidently link it to a specific solar park or wind farm. The research counts systems, not turbines or panels, with some of the systems controlling several turbines or an entire wind farm, Modat added.
Spain’s solar most exposed to cyber threats
The firm found 7,942 exposed systems in solar power plants in 34 countries. Spain alone accounts for 2,766 (35%). Together with Greece, Italy and Germany, the rest of the top four countries, it is 76% of the total.
There are 605 exposed systems in wind farms in 23 countries. Germany (212) and Italy (192) together account for 67%.
Exposure is if the web interface of a single wind turbine shows live production data, start, stop and reset controls, and the turbine’s location on a map, Modat explained.
El Yadmani: What we can map in hours, an attacker can map in hours too
The findings come after a joint statement from September 2026 by the Dutch intelligence and security services, National Cyber Security Centre (NCSC), National Coordinator for Security and Counterterrorism (NCTV), the Chief Information Officer of the Government the Government (CIO), the Public Prosecution Service and the police, which warned that AI is accelerating the threat.
According to Soufian El Yadmani, physically, wind and sun are the most robust parts of Europe’s energy supply.
“Digitally, they are fragmented, often exposed to the internet and not always monitored. What we can map in hours, an attacker can map in hours too. You can’t defend what you can’t see, and no one can see this whole landscape alone,” El Yadmani stressed.