A new cybersecurity study has identified 605 internet-facing systems associated with operating wind farms across 23 European countries, highlighting a growing digital security risk for increasingly connected renewable energy infrastructure. The findings come from Modat research presented at The ONE Conference in The Hague on October 6, 2026.
The research identified 8,547 exposed systems linked to operating wind farms and solar parks across 35 countries in the EU, EFTA and EU candidate states. Wind assets accounted for 605 of these systems, while 7,942 were associated with solar parks. Germany had the largest number of exposed wind systems at 212, followed by Italy with 192, together representing about two-thirds of the identified wind exposure.
The exposure was not limited to ordinary monitoring pages. Researchers found internet-accessible administrative and operational interfaces, including a wind turbine interface displaying live production information, the turbine's location and controls labeled for starting, stopping and resetting equipment. Some interfaces were positioned at a higher control level and could manage multiple turbines or an entire wind farm.
A particularly significant feature of the research was the use of machine-learning clustering through Modat's Magnify platform. Instead of relying only on predefined device signatures, the system grouped internet-facing infrastructure and helped identify equipment types that researchers had not specifically programmed it to find. This approach allowed exposed systems to be connected to operating renewable energy sites and demonstrated how quickly a large renewable energy attack surface can be mapped.
Researchers estimated that around 181 of the identified sites could potentially have allowed full operational control. This does not mean that all 181 systems were successfully compromised or that an attack had taken place. Rather, the finding indicates that the publicly reachable interfaces may have provided a pathway to operational functions that should normally remain protected from direct internet access.
The geographical concentration also creates a grid-level concern. The researchers highlighted wind and solar facilities closely connected to public infrastructure, such as cities and airports, because disruption at individual renewable assets could have wider consequences where several facilities or control systems are affected simultaneously. The issue is particularly important as distributed renewable generation becomes a larger part of European electricity supply.
The study also points to a broader operational technology challenge. Wind farms depend on interconnected control, monitoring and communications systems supplied by turbine manufacturers, operators and service providers. An internet-facing component can therefore become an entry point into a much larger operational environment, making asset visibility and supplier-level security important alongside conventional IT cybersecurity measures.
The researchers have not publicly disclosed the names, IP addresses or precise locations of the identified facilities. Instead, the findings were aggregated by country and affected parties were notified through national CERT channels. The approach is intended to allow operators to investigate and secure exposed systems without publishing information that could make specific renewable assets easier to target.
The findings add urgency to efforts to remove unnecessary administrative interfaces from the public internet, strengthen protected remote-access arrangements and continuously monitor the external attack surface of renewable assets. For wind operators, cybersecurity is increasingly becoming part of generation reliability itself as digital controls move closer to the physical operation of turbines and entire wind farms.