Spain Tops Europe for Solar Systems Exposed to the Internet

Spain has the most internet-exposed solar farm systems in Europe, according to a new study by the cybersecurity platform Modat Magnify. The report, titled "To See the Wind and the Sun", was produced with Bouke van Laethem of the Dutch National Cyber Security Centre (NCSC-NL).

Researchers scanned wind and solar parks in 35 countries, covering EU members, candidate countries and EFTA states. They identified 8,547 systems reachable from the public internet without adequate protection: 7,942 solar interfaces and 605 wind ones. Some are management panels for a single turbine, while others control several turbines or an entire site from one screen.

Spain at the top of the solar list

Some 2,766 systems tied to Spanish solar installations are accessible online, about 35% of those detected. That puts Spain first in solar, while Germany and Italy lead in wind. Modat founder Soufian El Yadmani links this to the size of Spain's renewable fleet and its large number of solar plants. Other suggested explanations include a fragmented supplier landscape, turnover among technical staff and rapid growth in installed capacity.

According to El Yadmani, some panels had no authentication or protection at all. In theory, anyone with an internet connection could stop, restart or reboot a turbine. The researchers also reached industrial controllers that give instructions to machinery, and opened a turbine's web interface to see its real-time output and location.

Exposed does not mean attacked

The study stresses that exposure does not mean a system has been breached, and the figures count interfaces and digital systems, not separate plants. Still, a successful attack could have national impact. Modat and NCSC-NL recommend removing administration interfaces from the public internet, tightly controlling access by vendors and external contractors, and keeping manual control of industrial systems for use during an incident.

The true scale is likely larger. The numbers include only systems that could be reliably attributed to a specific installation, and the researchers say many more vulnerable systems could not be linked to a site for lack of information.