An investigation by the Dutch company Modat and the National Cybersecurity Center of the Netherlands (NCSC-NL) has identified 2,766 computer systems linked to solar installations in Spain accessible from the internet that, according to the researchers, should not be exposed to the public network. The figure represents 35% of the 7,942 solar systems located in the set of analyzed countries.
The study, presented on October 6 at the ONE Conference in The Hague, examined solar installations and wind farms in 40 European countries, including members of the European Union, the European Free Trade Association, and candidate countries to enter the EU. The researchers found exposed systems in 35 countries and counted 8,547 in total, among solar and wind installations.
The distinction is fundamental: having an exposed system does not mean that a cyberattack has occurred. The count identifies equipment and applications accessible from the internet, not confirmed intrusions or necessarily compromised installations.
What the researchers have found
Of the 8,547 identified systems, 7,942 were associated with solar installations spread across 34 countries. Spain topped the count, ahead of Greece, with 1,860; Italy, with 753; and Germany, with 672. These four countries accounted for 76% of the located solar systems.
The study identified another 605 systems linked to wind farms in 23 countries. In Spain, 11 of this type were located, a figure much lower than that corresponding to photovoltaic generation.
The researchers did not count residential installations on rooftops. Additionally, they applied a restrictive criterion: they only included systems that could be securely linked to a specific solar or wind farm. Therefore, they consider that the results represent a minimum and not the complete inventory of potentially exposed equipment.
From an accessible screen to equipment control
The exposure can have different levels of severity. In some cases, an interface accessible from the internet displays operational information and requires credentials to continue. In others, the researchers found administration panels without authentication or protection, as well as industrial systems that allow sending instructions to the equipment.
The report describes, for example, the web interface of a wind turbine that displayed real-time production data and included start, stop, and restart controls. It also documents access to industrial controllers and pages that identified the facilities they serviced.
The scope of each exposure depends on the available functions and the affected system. A team can manage a single device or cover several; therefore, the number of detected systems does not allow for a direct calculation of how many facilities could be affected by an incident.
What measures does the report recommend
Modat and the NCSC-NL recommend removing management interfaces from the internet and preventing industrial control systems from being directly accessible from the public network. The report also suggests reviewing the permissions and access of suppliers and service companies involved in the management of the facilities.
Researchers warn that the same techniques used to locate exposed equipment can be exploited by third parties to identify them. The work employed clustering tools using machine learning to recognize similar systems and locate devices without previously defined search rules.
The research does not provide a public list that allows for concluding which Spanish facilities have been compromised nor does it confirm that the 2,766 systems have suffered unauthorized access. Its main contribution is to identify a digital exposure surface that operators must review and protect.