As Europe's solar capacity expands with decentralised networks, regulatory developments and geopolitical tensions highlight emerging cybersecurity vulnerabilities, prompting calls for stronger protections across the sector.
The rapid expansion of solar power infrastructure across Europe and beyond has significantly elevated its role as a vital component of modern energy systems. However, this growth has also exposed various cybersecurity vulnerabilities within the sector. Historically, energy grids operated through centralized, analogue systems—large, regulated power plants that prioritized safety and security. Today, with the rise of decentralized, digital solar networks—comprising numerous smaller installations—the oversight of cybersecurity is often inconsistent or lacking. Data indicates that in Europe, over 120 gigawatts of solar capacity come from sites smaller than 25 MW, many of which are not subject to stringent cybersecurity regulations.
Modern solar components, particularly inverters that convert sunlight into electricity, are highly interconnected and often internet-enabled. While utility-scale plants usually have dedicated security measures such as remote monitoring systems, many smaller sites utilize internet-connected devices that operate with default or weak passwords, making them susceptible to unauthorized access. These vulnerabilities enable potential hackers to remotely control systems, risking power fluctuations or even grid failures.
In response, regulatory developments in Europe are gradually strengthening the security framework. In 2024, regulations like the European Radio Equipment Directive (RED) Article 3.3 and the UK's PSTI Act introduced basic standards—such as unique and complex passwords and data protections—that set a baseline for connected device security. Looking ahead, the Cyber Resilience Act has been passed and will come into effect gradually over the next two years. Furthermore, the EU’s NIS2 Directive, expected to be adopted across all member states within the next year, will assign clearer responsibility and liability for cybersecurity risks to asset owners, operators, and critical service providers. These initiatives aim to ensure that those managing solar assets are held accountable for cybersecurity, especially considering the potential consequences of breaches, including blackouts.
Despite these advances, gaps remain, especially concerning how manufacturers manage device communications and firewall controls—particularly for smaller utility plants which constitute the majority of solar generation in Europe. Some countries, such as Lithuania, have already imposed strict connectivity limitations on solar devices based on cybersecurity concerns, even retroactively, despite the costs involved. Countries like Germany are also in the process of developing bespoke regulations, underscoring the increasing focus on tailored policies.
Concrete threats have already been identified through research. For example, a study by Forescout-Vedere Labs uncovered 46 vulnerabilities in major inverter manufacturers like Sungrow, Growatt, and SMA. These weaknesses could allow hackers to manipulate energy output, disrupt power supplies, or steal sensitive data, threatening energy grid stability. The vulnerabilities often stem from outdated firmware, weak authentication, exposed APIs, and unencrypted data transmissions. Such security gaps not only risk physical power disruptions but also pose privacy violations and operational chaos.
Geopolitical tensions have heightened concerns about foreign-manufactured components, especially from China. The U.S. Department of Transportation's Federal Highway Administration issued a security advisory warning about rogue communication devices—such as hidden cellular radios—embedded in solar power inverters and batteries, suspected to be of Chinese origin. These undocumented radios could potentially enable remote manipulation, posing a threat to critical infrastructure like traffic management systems, weather stations, and electric vehicle chargers. The U.S. is actively investigating these risks, and many countries, including Lithuania and Estonia, are reassessing their reliance on Chinese technology for critical infrastructure, driven by national security considerations. Chinese companies such as Huawei, Sungrow, and Ginlong Solis supply substantial portions of the global inverter market, further fueling concerns over foreign control.
Looking forward, the industry must adopt a proactive stance to cybersecurity. Owners, operators, and maintenance firms for large-scale solar plants are expected to bear increased legal responsibilities akin to those for physical security measures—necessitating investments in advanced hardware and software protections beyond traditional firewalls and VPNs. Maintaining detailed inventories of physical components and understanding evolving compliance requirements will be critical. Similarly, homeowners and small business owners should prioritize installing inverters with robust cybersecurity features—such as secure passwords, encrypted communication, and manufacturer reputation—while manufacturers must prioritize embedding comprehensive security features into their product designs. Simple yet effective solutions, like QR-code-based cryptographic setups or biometric authentication, can provide strong security without complicating installation.
The solar industry must view cybersecurity as a fundamental safety standard—comparable to fire safety or electrical codes. Just as seat belts and airbags became essential safety features in vehicles, cybersecurity must be recognized as a non-negotiable necessity in solar system design and operation. Failing to do so risks regulatory penalties, security breaches, and potential disruption of critical energy infrastructure. As awareness continues to grow, companies and regulators should work collaboratively to embed security measures into the fabric of solar energy systems, ensuring sustainable growth and resilience against evolving digital threats. Prevention, after all, remains the best approach to safeguarding our energy future.
Source: Noah Wire Services
Verification / Sources
- https://www.pv-magazine-india.com/2025/09/10/the-cybersecurity-gap-in-solar-and-how-to-close-it/ - Please view link - unable to able to access data
- https://www.reuters.com/legal/government/us-warns-hidden-radios-may-be-embedded-solar-powered-highway-infrastructure-2025-09-10/ - The U.S. Department of Transportation's Federal Highway Administration has issued a security advisory warning that solar-powered highway infrastructure could contain rogue communication devices, such as hidden cellular radios embedded in batteries and inverters. These warnings follow increased concerns over Chinese technology in U.S. infrastructure and the potential for such components to be remotely accessed or manipulated. The advisory, dated August 20, cites instances where undocumented radios were found in foreign-manufactured inverters and battery management systems, often suspected to be made in China. The alert urges transportation agencies to inventory and inspect such systems—used in traffic cameras, weather stations, EV chargers, and signage—for unauthorized communications hardware using spectrum analysis. Recommended actions include removing the devices and improving network security. This comes amid broader efforts by U.S. authorities to reduce national security risks posed by foreign technology in critical infrastructure, including banning most Chinese cars from U.S. roads by 2026. China has denied the allegations, opposing what it calls a smear of its energy infrastructure technologies.
- https://www.pveurope.eu/node/244909 - While utility-scale PV systems benefit from experienced operators and stricter standards, smaller systems often lack comparable protection and monitoring. Components such as inverters are typically too small to qualify as critical infrastructure (KRITIS) and are therefore not covered by existing EU regulations such as the Cyber Resilience Act (CRA), the Network and Information Systems Code on Cybersecurity (NCCS), the NIS2 Directive or the General Data Protection Regulation (GDPR). SolarPower Europe pushes for sector-specific cybersecurity rules. As a result, many manufacturers, installers and service providers with remote access to small PV systems are not bound by any cybersecurity requirements. The lack of a single accountable operator also makes it difficult to apply consistent standards across individual projects. Market concentration increases systemic risk. In 2023, twelve major inverter manufacturers – nine based in China – accounted for 85% of the global market, representing 536 GW of installed capacity.
- https://www.techradar.com/pro/millions-of-solar-power-systems-could-be-at-risk-of-cyber-attacks-after-researchers-find-flurry-of-vulnerabilities - A study by Forescout-Vedere Labs has revealed 46 new vulnerabilities in three major solar inverter manufacturers: Sungrow, Growatt, and SMA. These vulnerabilities allow hackers to manipulate energy production, disrupt power grids, and steal sensitive data, posing serious risks to global energy infrastructure. Internet-connected solar inverters are easy targets due to outdated firmware, weak authentication, and unencrypted data transmissions. Exposed APIs could enable hackers to manipulate user accounts and inverter settings, causing power disruptions. Additionally, insecure object references and cross-site scripting (XSS) vulnerabilities could expose user emails, physical addresses, and energy consumption data, violating privacy regulations such as GDPR. Beyond grid instability, compromised inverters create further risks, including data theft, financial manipulation, and smart home ... . Some vulnerabilities allow attackers to take control ... . Cybercriminals could also alter inverter ... The report recommends that manufacturers prioritize patches, adopt secure coding ... . Implementing Web Application Firewalls ( ... . Regulators are also urged to classify solar ... . For solar system owners and operators, ... . Installing the best antivirus software adds an ... .
- https://www.energy.gov/eere/solar/solar-cybersecurity-basics - Solar energy technologies can be vulnerable to cyberattack through inverters and control devices that are designed to help manage the electric power grid. Operating-technology (OT) devices like solar photovoltaic inverters, when connected to the Internet, are at higher risk relative to stand-alone OT devices. They must be able to prevent, detect, and respond to unauthorized access or attack. While some cyberattacks manipulate information-technology (IT) systems, cyberattacks on electric-grid devices can cause physical impacts like loss of power and fires. The electric grid is becoming increasingly digitized and connected, so maintaining cybersecurity is a top priority for the U.S. Department of ... (DOE). There are daily attempts to attack the grid, but the majority are not successful. Cyber-physical systems are engineered systems that are built from, and depend upon, the seamless integration of computation and physical components.
- https://www.reuters.com/sustainability/climate-energy/ghost-machine-rogue-communication-devices-found-chinese-inverters-2025-05-14/ - U.S. energy officials are investigating security threats posed by Chinese-manufactured solar power inverters and batteries after discovering rogue, undocumented communication devices in some units. These inverters are crucial for integrating solar panels, wind turbines, and batteries into electricity grids. Experts fear these components could bypass firewalls, allowing remote manipulation, potentially destabilizing power grids and causing large-scale blackouts. While the Chinese embassy denies malicious intent, U.S. lawmakers and analysts warn of the growing risk of cyber threats from China, especially as Chinese companies dominate the global inverter market. Chinese firms like Huawei, Sungrow, and Ginlong Solis supplied over 200 GW of inverters to Europe, raising concerns about foreign control over energy infrastructure. The U.S. and countries including Lithuania, Estonia, and the UK are reevaluating Chinese technologies in critical systems. The U.S. has proposed legislation to reduce dependency on Chinese batteries and may expand restrictions to inverters. The Department of Energy is working to ensure transparency through measures like Software Bills of Materials. The energy sector, slower than telecoms in establishing safeguards, now recognizes the need to mitigate strategic dependencies amid rising geopolitical tension.
- https://www.techradar.com/pro/security/35-000-solar-pv-devices-hit-by-dozens-of-vulnerabilities-and-weaknesses-is-yours-one-of-them - A recent study by Forescout's Vedere Labs reveals that nearly 35,000 solar power devices—such as inverters, data loggers, and gateways—are exposed to the internet, leaving them vulnerable to cyber exploitation. Despite identifying 46 security vulnerabilities previously, many of these devices remain unpatched. Alarmingly, Europe, particularly Germany and Greece, accounts for 76% of these exposed systems. The exposure is linked to inadequate default configurations, outdated firmware, and poor user guidance rather than sheer market penetration. Devices like the obsolete SMA Sunny WebBox still contribute significantly to the risk. A notable example is the SolarView Compact, associated with a cyber incident in Japan in 2024 after a 350% rise in online exposure. Additionally, concerns are mounting over communication modules in Chinese-manufactured inverters, prompting security reassessments by governments. Experts warn that these seemingly low-impact devices could serve as gateways to critical infrastructure. Recommended countermeasures include retiring unpatchable devices, using secure VPNs for remote access, adhering to CISA and NIST guidelines, and implementing multiple security layers such as antivirus software, endpoint protection, and Zero Trust Network Access (ZTNA) architectures.
Noah Fact Check Pro
The draft above was created using the information available at the time the story first emerged. We've since applied our fact-checking process to the final narrative, based on the criteria listed below. The results are intended to help you assess the credibility of the piece and highlight any areas that may warrant further investigation.
Freshness check
Score: 8
Notes: The narrative presents recent developments in solar power cybersecurity, including the U.S. Department of Transportation's advisory on hidden radios in solar-powered infrastructure (reuters.com) and Forescout-Vedere Labs' identification of 46 new vulnerabilities in solar inverters (forescout.com). These events occurred within the past month, indicating high freshness. However, similar discussions on solar cybersecurity have been ongoing for several years, suggesting some recycled content.
Quotes check
Score: 7
Notes: The narrative includes direct quotes from Forescout CEO Barry Mainz and Head of Research Daniel dos Santos. These quotes are consistent with their statements in the referenced sources (forescout.com), indicating originality. However, the exact phrasing of some quotes varies slightly, suggesting potential paraphrasing.
Source reliability
Score: 9
Notes: The narrative references reputable sources, including the U.S. Department of Transportation's Federal Highway Administration and Forescout Technologies, a global cybersecurity leader. These sources are well-established and credible, enhancing the report's reliability.
Plausability check
Score: 8
Notes: The claims about cybersecurity vulnerabilities in solar power systems are supported by recent studies and advisories from credible organizations. The narrative aligns with known issues in the sector, such as the exposure of solar devices to cyber threats (forescout.com) and the identification of vulnerabilities in major inverter manufacturers (forescout.com). The language and tone are consistent with industry reports, and the structure focuses on relevant details without excessive off-topic information.
Overall assessment
Veredict (FAIL, OPEN, PASS): PASS
Confidence (LOW, MEDIUM, HIGH): HIGH
Summary: The narrative effectively presents recent developments in solar power cybersecurity, supported by credible sources and consistent with known industry issues. While some content may be recycled, the inclusion of recent events and original quotes from reputable figures enhances its credibility.