Key points
- Researchers found 8,547 exposed systems across 35 countries in and around the EU.
- Interfaces include login screens and turbine controls with direct stop buttons.
- Spain, Greece, Italy and Germany hold the majority of confirmed vulnerable systems.
The short version
- Modat and NCSC-NL discovered 8,547 internet-exposed systems at European wind and solar sites.
- Exposed interfaces allow remote access to login pages and operational controls like stop buttons.
- The actual number of vulnerable systems is likely higher than the confirmed count.
The details
Cybersecurity researchers from Modat and the Dutch National Cyber Security Centre (NCSC-NL) identified a significant exposure of critical energy infrastructure components across Europe. According to Help Net Security, the joint investigation revealed 8,547 internet-facing systems associated with wind farms and solar parks. These systems are located in 35 countries within and surrounding the European Union. The researchers determined that these devices should not be reachable from the public internet, yet they remain accessible to anyone with a browser.
The exposed interfaces vary in function but share a common risk profile. Some systems present simple login screens, while others offer direct operational controls. Help Net Security reports that certain turbine control pages provide a "Stop" button that is accessible to any visitor. This configuration allows unauthorised users to potentially halt energy generation remotely. The presence of such controls on public networks creates a direct vector for disruption without requiring complex exploitation techniques.
Geographic analysis of the findings indicates a concentration of vulnerabilities in specific regions. Operators in Spain, Greece, Italy and Germany account for the majority of the confirmed exposed systems. Despite this regional clustering, the issue spans a wide area across the continent. The researchers noted that the confirmed figure of 8,547 is likely a conservative estimate. The real number of exposed systems is probably higher, as detection methods may not capture every instance or may be limited by scanning constraints.
The context
The discovery highlights ongoing challenges in securing operational technology (OT) environments. Energy providers often struggle to balance remote management needs with security requirements. The involvement of the Dutch government’s cybersecurity centre underscores the seriousness of the threat to national infrastructure. Security Magazine confirmed the scope of the discovery, noting that more than 8,500 systems linked to European wind farms and solar parks were found exposed. This incident serves as a reminder that legacy systems and poorly configured network boundaries remain prevalent in the energy sector.
Defender's checklist
Organisations should review their network architecture to ensure operational technology is isolated from public networks. Security teams must verify that all remote access points are secured with strong authentication and encryption. Regular external vulnerability scans can help identify unintended exposures before malicious actors do. Incident response plans should include scenarios for remote disruption of physical assets.
What to do and how to stay safe: Modat
- Conduct an external perimeter scan to identify any energy management systems accessible from the public internet.
- Verify that all remote access interfaces require multi-factor authentication and are not exposed directly to the web.
- Review firewall rules to ensure operational technology networks are segmented from corporate and public networks.
- Monitor network logs for unusual access patterns or repeated failed login attempts on critical infrastructure interfaces.
Step-by-step guide: Credential Leaks: How Exposure Happens and How to Contain It
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many systems were found exposed?
Researchers identified 8,547 internet-facing systems across 35 countries in and around the EU.
What kind of controls are exposed?
Exposed systems range from login screens to turbine control pages that offer a Stop button to browser users.
Which countries are most affected?
Operators in Spain, Greece, Italy and Germany account for most of the confirmed exposed systems.
