8,547 power plant control systems in Europe were reachable from the internet: three checks for your plant

Researchers found 8,547 control systems at solar and wind plants in Europe that anyone could access from the internet. One of them was the web page of a single wind turbine. It showed live production data and start, stop and reset buttons.

What the researchers found

The research was carried out by Modat, a company based in The Hague, and the Dutch National Cyber Security Centre (NCSC-NL). They presented the results on 6 October 2026 at ONE Conference, also in The Hague.

The study covered operating solar and wind plants in 40 countries: EU and EFTA members and EU candidate countries. Rooftop solar plants were not included. The researchers found systems reachable from the internet in 35 of those 40 countries.

They found 7,942 such systems at solar plants and 605 at wind plants. Spain had the most, with 2,766 at solar plants alone.

They counted systems, not panels or turbines, and some of these systems control an entire wind farm. The researchers say the real number is probably higher.

Admin pages and control pages could be opened from the internet. For the wind turbine mentioned above, the web server of the PLC that controls it was also reachable. One login page stated that the default username was "root".

How the attack in Poland was carried out

On 29 December 2025, more than 30 wind and solar plants in Poland were attacked. According to the CERT Polska report, the attackers got in through a VPN that was reachable from the internet and did not require multi-factor authentication (MFA), and the same accounts were used at several facilities. At the grid connection substations, they logged in to the RTUs with default accounts and loaded corrupted firmware onto them. The plants could then no longer be controlled remotely, but power generation did not stop.

What this means for plant owners in BiH

The researchers did not publish a figure for BiH.

Plants in BiH also have RTUs like the ones the attackers disabled in Poland. A private plant connects to the grid operator's dispatch system through its RTU. We have done that integration at five or more plants.

Three checks the researchers recommend

1. Take admin pages off the internet.

Check whether the pages of your inverters, data logger, SCADA system and router open from an address outside the plant network. Allow remote access only through a VPN with MFA.

2. Assume the attacker is already in your network.

Change the default passwords on all devices, including the RTU, and do not use the same password at more than one plant. Plan in advance how to run the plant manually in case remote control fails.

3. Check what suppliers have connected to your plant's network.

Write down everyone who has access to your plant, through which device and with which account. The Dutch digital infrastructure inspectorate (RDI) sees the greatest risk in the cloud platforms of manufacturers and aggregators.

When the EU rules start to apply

The EU Cyber Resilience Act (CRA) applies only to products placed on the EU market on or after 11 December 2027, and a European Commission expert group has recommended placing solar inverters in a class that needs an independent conformity assessment before sale. These deadlines change nothing for equipment already running at your plant.

How we do it at COMEX

We see this as an operator too, because we run our own plant at Raduša. The plants we maintain can be controlled only through our encrypted VPN. Only our own staff use the control portal, from secure computers on secure networks. Our web portal requires a login and is for viewing data only. We monitor the VPN connections continuously and get an alert if one drops for more than a few minutes. The network equipment we install accepts cryptographic keys, not passwords. When a plant leaves our care, we shut off its access to our system and revoke its certificates.

Concerned about your plant's security? Get in touch at contact@comex.ba .

Sources

• pv magazine, 7 Oct 2026: Thousands of European solar park systems exposed online, say researchers
• Modat, 6 Oct 2026: Modat Research Shows More Than 8,500 Exposed Systems in Europe’s Wind and Solar Parks
• CERT Polska, 30 Jan 2026: Energy Sector Incident Report – 29 December 2025 and report (PDF)
• pv magazine, 17 Oct 2026: Dutch regulator flags EU cyber gap for cloud-controlled home batteries
• Rijksinspectie Digitale Infrastructuur (RDI), 7 Oct 2026: Position paper "Verbonden apparaten zetten het elektriciteitsnet onder druk"