What 8,547 internet-facing systems reveal about renewable energy security

In research published on 6 October 2026, Modat and the National Cyber Security Centre Netherlands described a web interface associated with a wind turbine that displayed its location, live production information and controls labelled Start, Stop and Reset. Their account did not establish whether the controls could be used without authentication or whether anybody had misused them.

That distinction is central to the broader project. The organisations reported identifying 8,547 internet-facing systems associated with operating wind and solar installations across 35 of the 40 European countries they examined.

The result is not evidence that thousands of renewable-energy systems were hacked. The public summaries report no confirmed compromise, active exploitation, outage, sabotage or data theft. Instead, the findings illuminate a less dramatic but consequential security problem: equipment spread across many physical sites can still depend on digital interfaces, remote connections and supplier relationships that are publicly discoverable or difficult to govern collectively.

What the number measures

Of the systems reported by Modat and NCSC-NL, 7,942 were associated with solar installations in 34 countries and 605 with wind installations in 23 countries. The Netherlands accounted for 141 systems.

The researchers described 8,547 as a lower bound because they included only systems they could confidently connect to a particular facility. Even so, the total should not be read as a count of turbines, solar panels, energy parks or confirmed security flaws. It measures systems.

That distinction affects the possible scale. One interface may serve a single asset, multiple turbines or an entire wind farm. The number of interfaces therefore does not reveal how many physical assets might sit behind them, and the public summaries do not provide a complete breakdown of those relationships.

The organisations withheld park names, operator identities, IP addresses and precise locations. According to the research release, affected parties were being approached through national CERTs. This limits public scrutiny of individual findings, but it also avoids turning an exposure study into a directory of operational assets.

The researchers said they used machine-learning clustering over internet-wide observations to group similar systems and recognise device types for which detection rules had not previously been written. That method allowed them to map patterns beyond a fixed list of already known interfaces. The public summaries do not include the complete methodology or operator-level validation, so the totals remain findings reported by Modat and NCSC-NL rather than an independently reproduced census.

Exposure is not compromise

The examples show why every result cannot be assigned the same severity. The research described both park-branded login pages and the turbine interface displaying operational information and controls. These are not equivalent observations.

A publicly visible login page establishes that a service can be discovered from the internet. It does not, by itself, reveal whether credentials are strong, access is otherwise restricted or the service is separated from operational equipment. A monitoring page may disclose information without providing administrative authority. An interface connected to park-level management or operational controls raises more serious questions, but controls visible on a page do not prove that an unauthorised user can activate them.

The published summaries do not provide a privilege, authentication and backend-segmentation assessment for each identified system. Describing the complete set as compromised, unauthenticated or uniformly exploitable would therefore go beyond the evidence.

Public exposure still matters. Internet-facing services form part of an organisation’s external attack surface, and discoverability can simplify the initial task of identifying relevant systems. The immediate defensive question is not whether every page permits a damaging action. It is whether operators know which interfaces exist, why they are reachable, who owns them and what systems sit behind them.

Distributed generation, shared access

Wind and solar generation is geographically dispersed, but its management does not occur in isolation. A US Department of Energy wind cybersecurity roadmap notes that modern wind plants and control centres use operational technology and industrial control systems that may include internet-facing features and remote-access paths.

Research from the US National Renewable Energy Laboratory also depicts connected relationships among generation environments, owner-operators, grid operators and original equipment manufacturers. That multi-party model helps explain why asset visibility is not simply a matter of an operator counting its own devices.

Remote access can cross organisational boundaries. Equipment manufacturers, maintenance providers and operators may each have a role around connected assets. An inventory therefore needs to record more than hardware. It must also account for architecture, access paths and supplier connections.

This does not make renewable energy inherently insecure, nor does the European study compare its net cyber risk with fossil-fuel, nuclear or other generation. Physical distribution can reduce some forms of concentration. The digital management layer presents a different question: whether access to many dispersed assets depends on shared interfaces, service arrangements or incomplete records.

The Modat and NCSC-NL findings suggest that public visibility can be uneven across this environment. A branded login page, a production display and an interface serving an entire park may all appear in an internet scan, even though their privileges and operational importance differ substantially. Security teams need that hierarchy of consequence if they are to prioritise remediation rather than treating every discovered service as identical.

Security beyond product purchasing

The researchers’ recommendations begin with a direct architectural measure: remove administrative and control interfaces from the public internet. They also advise using secure, monitored connectivity for operational access and maintaining visibility of assets, architecture and access routes, including links introduced by suppliers and service providers.

Those measures place governance alongside technical control. An organisation cannot reliably restrict an interface it does not know exists, or review supplier access when ownership of that connection is unclear. Nor does removing a public page settle the broader resilience question of how operations continue when connected systems are unavailable or no longer trusted.

The guidance therefore includes considering manual operation, adapting procedures to defined threat levels and sharing relevant information. Manual fallback is not a substitute for secure connectivity. It adds a recovery option when digital dependencies cannot be relied upon.

Coordination is also becoming an institutional concern in the Netherlands. On 2 June 2026, NCSC-NL and Energy Innovation NL joined a Dutch energy-resilience sector pact focused on knowledge sharing, threat-information exchange, clearer responsibilities, joint exercises and baseline security. The pact does not demonstrate that the recommended controls have been adopted across the facilities in the mapping project, but it reflects the cross-organisational character of the problem.

Machine-assisted discovery cuts both ways

The mapping project also demonstrates how automation can expand defenders’ field of view. Machine-learning clustering helped the researchers identify families of similar systems without relying exclusively on pre-written detection rules.

A separate assessment issued on 24 September 2026 by Dutch security and law-enforcement bodies warned that artificial intelligence is lowering barriers for attackers and accelerating vulnerability identification and exploitation. That assessment provides broader context, not evidence that AI was used to attack any renewable asset in the study.

The relevant symmetry is narrower. Techniques that help defenders organise large volumes of internet observation can also make exposure easier to catalogue. This increases the value of reducing unnecessary public access and maintaining an accurate internal inventory before an outside party maps the same environment.

The limits of an Australian lesson

The European figures cannot be transferred to Australia. The study supplied no Australian exposure count, identified no local operator and did not examine whether comparable practices are prevalent in the country.

Its architectural questions nevertheless remain relevant wherever renewable assets rely on remote monitoring, maintenance or supplier access. For Australian operators and policymakers, the useful questions concern whether external access paths are inventoried, how vendor privileges are governed, whether manual operating options are maintained and how organisations coordinate during an incident. Answering how well those tasks are performed locally would require Australian-specific reporting and evidence.

The turbine interface at the centre of the research is significant precisely because its visible controls do not tell the whole story. They do not prove an intrusion, but they expose the limits of judging operational security from the outside. For distributed energy, the essential digital layer is not merely connected. Operators need to be able to see it, assign responsibility for it and recover when they can no longer trust it.

When remote access crosses boundaries between operators and suppliers, network knowledge and clear ownership need to work together. Make networking one area to explore through The Hack Academy’s online cybersecurity training programme; learning is self-paced, and practical exercises sit alongside theory.