Anyone with a web browser could have opened the control page of a wind turbine somewhere in Europe, watched its live output and pressed Stop. That page is one of 8,547 systems belonging to wind farms and solar parks that researchers from the Dutch internet intelligence firm Modat, working with the Dutch government's national cyber security agency, NCSC-NL, found reachable from the public internet, none of which should have been.
The research, unveiled on October 6 at The Hague's ONE Conference, mapped operating wind and solar sites in 40 countries across the EU, EFTA and the EU candidate states, and turned up exposed systems in 35 of them. What it found ranges from login pages that name the park they guard to administrative interfaces and control panels for individual turbines and, in some cases, for entire farms.
Where the exposure sits
Solar makes up the bulk of the count: 7,942 systems in 34 countries. Spain alone has 2,766 of them, about 35 percent of the solar total, and with Greece, Italy and Germany added, the top four hold 76 percent. Wind contributes 605 systems spread over 23 countries, with Germany (212) and Italy (192) leading the count and holding two thirds of it between them. The Netherlands, home to both research teams, has 132 exposed solar systems and nine on the wind side.
The authors stress that 8,547 is a floor. A system was counted only once it could be tied with confidence to a specific park, and many more with the same fingerprints are still waiting to be attributed. The count is of systems rather than of individual turbines or panels, and some of the exposed systems manage several turbines at once, so a single address can represent a large slice of a farm's output rather than one machine.
A Stop button and a map
The example the researchers chose to illustrate the problem is the browser interface of one turbine. It shows live production figures, offers controls to Start, Stop and Reset it, and has a map page that gives away where the machine stands. One more menu entry opens the embedded web server of the Siemens logic controller in charge of the machine. Two of the login pages identified the wind park behind them by name, and one displayed its default username, root. Much of what was found is administrative or login interfaces, but by the researchers' estimate, 181 of the sites were exposed in a way that could have handed an outsider full operational control, meaning the ability to change how a plant ran rather than merely watch it. The report documents exposure, not intrusion: it makes no claim that any of these systems has been attacked.
Why the grid should care
In the second quarter of 2026, Eurostat figures cited in the report put renewables at 54 percent of the EU's electricity, most of it solar and wind. Dispersed sites are hard to hit physically, which is exactly why Ukraine has leaned on them, but online, distance means nothing and a remote site is no safer than a central one. The report points to what happened in Poland in December 2025, when intruders came in through internet exposed firewalls, many without a second authentication factor, logged in with default passwords and shut down remote terminal units, protection relays and other substation equipment at no fewer than 30 wind and solar farms. Those sites lost contact with their grid operators even though they kept generating.
A turbine that can be stopped from a browser is a local nuisance. Thousands of reachable systems, including controllers for whole farms, are a different matter, because large and sudden swings in generation are exactly what grid operators work to avoid. The report's first recommendation is accordingly blunt: take administrative interfaces off the internet now. Beyond that, Modat and NCSC-NL suggest that operators:
- Work on the assumption that an intruder is already in the network, and monitor accordingly.
- Rebuild remote access along the published principles for operational technology, retain the ability to run a site manually, and keep an inventory of assets, architecture and access that includes every connection a supplier or service provider brings in.
- Share what they learn with the rest of the sector, at home and across Europe.
Only aggregated figures per country are being published. Park names, operators, addresses and locations stay private, and affected owners are being told through their national CERTs. Modat is asking other national response teams to help trace the remaining systems to their owners, and the report itself says the attributed total is not the whole picture.
