Internet-Facing Renewable Controls: 8,547 Exposed Systems in 35 Countries Raise Critical Infrastructure Concerns
Dutch and Israeli teams identified thousands of internet-facing renewable energy controls in 35 countries, raising urgent concerns for MSPs managing critical infrastructure.
Key points
- Modat and NCSC-NL discovered 8,547 exposed systems in wind and solar parks across 35 countries.
- Most confirmed systems belong to operators in Spain, Greece, Italy, and Germany.
- Some exposed interfaces include login screens and turbine stop buttons accessible via web browsers.
Dutch government cybersecurity center NCSC-NL and Israeli firm Modat identified 8,547 internet-facing control systems at European wind farms and solar parks. According to Help Net Security, these systems span 35 countries in and around the EU and should not be reachable from the public internet. The findings highlight significant exposure risks for managed service providers overseeing energy infrastructure.
How it unfolded
- Researchers conducted a scan across Europe to identify internet-connected renewable energy control systems.
- The team discovered 8,547 systems that were publicly accessible without proper network segmentation.
- Help Net Security reported that the actual number of exposed systems is likely higher than the confirmed count.
Who is affected
Operators in Spain, Greece, Italy, and Germany account for the majority of the confirmed exposed systems, according to Help Net Security. The exposed interfaces range from simple login screens to turbine control pages that offer a "Stop" button to anyone with a web browser. This direct access allows potential attackers to interrupt power generation or gain initial footholds in operational technology networks.
The fix
No official patch or vendor update has been confirmed for these exposed systems yet. The exposure stems from configuration errors rather than a specific software vulnerability, meaning remediation requires immediate network segmentation and access control reviews. Organizations must verify that their operational technology networks are isolated from the public internet to prevent unauthorized access to critical controls.
Background: Network segmentation
Avoid these common segmentation errors: using flat VLANs, ignoring east-west traffic, relying on static rules, and neglecting micro-segmentation. Each mistake creates lateral movement paths for attackers. Fix them by enforcing zero trust principles, auditing flows regularly, and isolating critical assets dynamically.
Read the full guide: Network Segmentation Mistakes That Leave Your Data Exposed
What to do and how to stay safe: NCSC-NL
- Audit all internet-facing assets to ensure operational technology systems are not publicly accessible.
- Implement strict network segmentation to isolate control systems from corporate and public networks.
- Review firewall rules to block unauthorized access to turbine and solar park management interfaces.
- Monitor for unusual traffic patterns on critical infrastructure networks to detect potential intrusion attempts.
Step-by-step guide: Breach Notification Protocol: A Step-by-Step Implementation Plan
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many systems were found exposed?
Researchers identified 8,547 internet-facing systems at wind farms and solar parks across 35 countries.
Which countries are most affected?
Operators in Spain, Greece, Italy, and Germany account for most of the confirmed exposed systems.
Is there a patch available?
No fix has been confirmed yet, as the issue relates to network configuration rather than a software bug.
