{"id":26797,"date":"2026-10-11T23:23:06","date_gmt":"2026-10-11T22:23:06","guid":{"rendered":"https:\/\/visegradpost.com\/?p=26797"},"modified":"2026-10-11T23:23:06","modified_gmt":"2026-10-11T22:23:06","slug":"thousands-of-european-wind-and-solar-sites-reachable-online-but-few-confirmed-attacks","status":"publish","type":"post","link":"https:\/\/visegradpost.com\/en\/2026\/10\/11\/thousands-of-european-wind-and-solar-sites-reachable-online-but-few-confirmed-attacks\/","title":{"rendered":"Thousands of European wind and solar sites reachable online, but few confirmed attacks"},"content":{"rendered":"<p>A team of researchers in the Netherlands, in cooperation with the country\u2019s national cyber security centre, counted 8,547 wind and solar installations across 35 European countries that were reachable from the internet when they should not have been.<\/p>\n<section aria-labelledby=\"hpd-nfnmyipv-inrtzyj-hlesdml-zofjqh\" class=\"auk-zvimcvi-inrtzyj\" lang=\"en\">\n<h2 id=\"hpd-nfnmyipv-inrtzyj-hlesdml-zofjqh\">In brief<\/h2>\n<ul>\n<li>The smaller figure is the sharper one: according to Reuters, roughly 181 of those sites seemed to present interfaces that could do more than display data, including commands to start or stop turbines.<\/li>\n<li>Renewable generation is scattered over rooftops, farmland, industrial plots and isolated hillsides.<\/li>\n<li>None of these steps requires abandoning connected infrastructure; the author explicitly rejects reading the findings as a case against renewable energy or networked systems.<\/li>\n<\/ul>\n<\/section>\n<div class=\"auk-kmrcibp\">\n<div class=\"auk-fsnsbv\"><strong class=\"auk-fsnsbv__fvtkh\">8,547<\/strong><span class=\"auk-fsnsbv__ppkniutc\">wind and solar systems reachable online<\/span><\/div>\n<div class=\"auk-fsnsbv\"><strong class=\"auk-fsnsbv__fvtkh\">35<\/strong><span class=\"auk-fsnsbv__ppkniutc\">European countries concerned<\/span><\/div>\n<div class=\"auk-fsnsbv\"><strong class=\"auk-fsnsbv__fvtkh\">181<\/strong><span class=\"auk-fsnsbv__ppkniutc\">sites with apparent control interfaces<\/span><\/div>\n<\/div>\n<p>The headline count describes reachability. The smaller figure is the sharper one: according to Reuters, roughly 181 of those sites seemed to present interfaces that could do more than display data, including commands to start or stop turbines. In an opinion piece for <a href=\"https:\/\/dailynewshungary.com\/european-renewable-energy-cybersecurity-risks\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Daily News Hungary<\/a>, the security and control-room researcher Abdulla Saeed Alhebsi argues that this finding deserves precision rather than alarm. What the researchers documented, he writes, were exposed systems and possible routes to control, and he warns against treating each such discovery as the prelude to an unavoidable cyber disaster.<\/p>\n<p>For Central Europe the issue is not abstract. Alhebsi notes that Hungary is embedded in a European energy system that grows more interconnected each year, with national installations, regional grids and digital services relying on each other, so a renewable asset that can be reached remotely becomes a concern beyond one site\u2019s IT team.<\/p>\n<h2>Why connected renewables are harder to fence in<\/h2>\n<p>Connectivity itself is not the villain in Alhebsi\u2019s account. Online links let operators watch, service and balance modern energy assets efficiently; remote access cuts downtime and spares engineers a trip to every location when equipment needs diagnosing.<\/p>\n<figure class=\"hpd-nfnmyipv-imzntj-gogcn\"><img decoding=\"async\" alt=\"A person in a purple and white jacket operates a control panel, with a laptop and a second console with joysticks on a table.\" loading=\"lazy\" src=\"https:\/\/visegradpost.com\/wp-content\/uploads\/2026\/10\/person-in-purple-and-white-jacket-operates-control-panel.jpg\" \/><figcaption>A person operates a control panel next to a laptop and a second console with small joysticks, on a table covered with a black cloth. <span class=\"auk-gogcn-ertkm\" data-provider=\"pexels\">Source: <a href=\"https:\/\/www.pexels.com\/photo\/audio-technician-operating-mixer-and-laptop-39579110\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Pexels<\/a>. Credit: <a href=\"https:\/\/www.pexels.com\/@sinan-kriya-2162662325\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Sinan KRIYA<\/a>. License: <a href=\"https:\/\/www.pexels.com\/license\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Pexels License<\/a>.<\/span><\/figcaption><\/figure>\n<p>The difficulty is geography. A conventional power plant gathers its machinery, its staff and its security measures inside one defined compound. Renewable generation is scattered over rooftops, farmland, industrial plots and isolated hillsides. In that landscape, Alhebsi writes, every inverter, turbine controller, gateway, supplier login and remote-maintenance channel may end up forming part of the operational perimeter that has to be defended.<\/p>\n<h2>Reach, authority and consequence<\/h2>\n<p>To sort serious exposure from harmless visibility, Alhebsi proposes what he calls a Reach-Authority-Consequence test. Three questions apply to any asset: who is able to get to it, what that access entitles them to do, and what physical outcome could result.<\/p>\n<p>The answers separate very different credentials. A login limited to reading output figures is not equivalent to one that can halt machinery, and he argues that a site\u2019s security design should make that gap obvious. His rule for maintenance follows from it: such an account should carry precisely the rights maintenance demands, only for the period it is required, and nothing beyond.<\/p>\n<p>Paperwork alone cannot confirm this. A procurement checklist may certify that a product offers encryption, authentication or logging, Alhebsi observes, yet it says nothing about the effect of a hijacked contractor account, whether a remote instruction could override a local safety mechanism, or how fast a control room could cut off a connection. As an example, he cites a project unveiled on 6 October in the United Arab Emirates: the national cyber security council and SCC Middle East intend to create a centre of excellence focused on cyber resilience and trusted technology, in which public bodies, companies and specialists would test concrete cases and look at how to deploy such systems securely on a large scale.<\/p>\n<h2>Where owners can start<\/h2>\n<p>Alhebsi lists a sequence of practical measures for asset owners:<\/p>\n<ol class=\"auk-eugnl\">\n<li>Find every operational interface that can be reached from the internet.<\/li>\n<li>Take down any public exposure that is not needed.<\/li>\n<li>Split monitoring rights from command rights.<\/li>\n<li>Restrict and tighten supplier access.<\/li>\n<li>Check that operators can withdraw remote privileges quickly.<\/li>\n<\/ol>\n<p>None of these steps requires abandoning connected infrastructure; the author explicitly rejects reading the findings as a case against renewable energy or networked systems.<\/p>\n<p class=\"media-credit auk-gogcn-ertkm\" data-provider=\"pexels\"><small>Featured image. Source: <a href=\"https:\/\/www.pexels.com\/photo\/expansive-solar-and-wind-energy-farm-in-vietnam-35105459\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Pexels<\/a>. Credit: <a href=\"https:\/\/www.pexels.com\/@quang-nguyen-vinh-222549\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Quang Nguyen Vinh<\/a>. License: <a href=\"https:\/\/www.pexels.com\/license\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Pexels License<\/a>.<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"<p>About 181 renewable sites appeared to offer interfaces able to switch turbines on or off, sharpening the case for strict limits on remote access rights.<\/p>","protected":false},"author":6,"featured_media":26799,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29],"tags":[1185,449,1050,1156,99,1113,1184],"class_list":["post-26797","post","type-post","status-publish","format-standard","has-post-thumbnail","category-environment","tag-critical-infrastructure","tag-cybersecurity","tag-europe","tag-hungary","tag-renewable-energy","tag-solar-power","tag-wind-power"],"_links":{"self":[{"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/posts\/26797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/comments?post=26797"}],"version-history":[{"count":2,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/posts\/26797\/revisions"}],"predecessor-version":[{"id":26805,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/posts\/26797\/revisions\/26805"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/media\/26799"}],"wp:attachment":[{"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/media?parent=26797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/categories?post=26797"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/visegradpost.com\/en\/wp-json\/wp\/v2\/tags?post=26797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}