Spain is home to 2,766 internet-reachable systems tied to solar installations — roughly one in every three detected across Europe — according to research by internet-intelligence firm Modat. The scan covered solar and wind farms in 35 countries and surfaced 8,547 systems exposed to the public network, many of them lacking the safeguards they should carry. The findings were published by Modat Magnify alongside a researcher from the Netherlands’ national cybersecurity centre.
One clarification matters from the outset: exposed does not mean attacked. The study counts interfaces visible from the internet, not intrusions.
- Scale of the finding: 7,942 solar-farm systems and 605 wind systems were reachable when they should not have been.
- Severity varies: many endpoints merely prompt for credentials, but some control panels had no authentication or protection whatsoever.
- Concentration: Spain, Greece, Italy and Germany account for 76% of the solar systems found; Germany and Italy hold 67% of the wind systems.
What the Scan Actually Uncovered
The exposed assets are control panels for renewable installations reachable from the public network — and in some cases with no password at all. Some are the management interface for a single turbine; others govern several turbines, or an entire farm, from a single screen.
Modat founder Soufian El Yadmani told reporters that investigators found panels with “no authentication or protection of any kind”, from which a system could be halted, started or rebooted. The researchers reached industrial controllers that issue commands to machinery, and one login page even revealed that the default user was “root” — the account with the highest privileges.
In cases without authentication, “it isn’t even necessary to exploit a vulnerability,” El Yadmani said.
He attributes Spain’s leading position primarily to the sheer size of its solar fleet relative to other European countries. Additional factors cited include a fragmented supplier landscape, high turnover among technical staff, and the rapid growth of installed capacity.
Context helps explain the numbers: renewables generated 54% of EU electricity in the second quarter of 2026, according to Eurostat, and Spain is a solar heavyweight. More installations means, almost by definition, more surface area to monitor.
The Real Risk: Remote Shutdown of Grid-Feeding Assets
The study stresses that Spain’s 2,766 exposed systems do not equal 2,766 cyberattacks. But El Yadmani warns that in a severe scenario — where an attacker reached the necessary systems and took them offline — the impact could extend to an entire city or country. The absence of authentication in some cases makes that prospect considerably easier.
This connects to a broader trend: AI is increasingly lowering the barrier to attacks on critical infrastructure such as the power grid. El Yadmani’s summary is blunt — what Modat can map in hours, an attacker can map too. Modat and the Dutch centre recommend removing administrative interfaces from the internet, tightly controlling third-party supplier access, and retaining the ability to operate systems manually during an incident.
Reading the Numbers With Caution
The figures deserve scrutiny in two respects, and both make the picture worse rather than better. First, the 8,547 systems are only those Modat could confidently attribute to a specific installation; more exist that could not be linked for lack of information. Second, the report is dated 6 October and country-level breakdowns appear only in the full document, which requires a form to download — the figures cited here come from reporting that interviewed the researcher directly.
The headline that Spain “leads” is accurate but misleading, because it rewards the country that measures most. What matters is not the ranking but the fact that solar-farm panels sit open on the internet without passwords. That is not a Spanish problem; it is a sector-wide problem. Renewables have grown extremely fast, across many different suppliers, and equipment has been connected to the network without much thought for who can see it from outside. The good news is that the fix, in most cases, is not sophisticated: take those interfaces off the public internet. The bad news is that, as with systems that no longer receive updates, nobody fixes what they do not know they have connected.