Italy: After Refrigerators, Will Solar Power Systems Be the Next Target?

Why the risk on photovoltaics: In the cyber intelligence analysis conducted by Wateronmars, by Alex Orlowski, reviewed by Cybersecurity Italia, it is stated that inverters, dataloggers, gateways, and RTUs share the same risk profile as the internet-connected refrigeration units by Danfoss, which were disrupted in recent days in several EU countries. Furthermore, the analyzed photovoltaic systems also feature the manufacturer’s cloud as a control pathway, unauthenticated Modbus/TCP, and unattended sites.

On December 29, 2025, a coordinated cyberattack in Poland targeted numerous sites within the electrical system connected to distributed generation, with over 30 wind and solar power plants specifically targeted through their grid connection substations (RTU, HMI, protection relays).

Although the offensive was unsuccessful and did not cause any interruptions in electricity supply, it was classified by the Polish Cyber Forces Command as the most significant attack on energy infrastructure in recent years.

On January 23, security researchers attributed the incident with medium confidence to the Russian state-sponsored group Sandworm.

According to a cyber intelligence analysis conducted by Wateronmars, led by Alex Orlowski and reviewed by Cybersecurity Italia, following the cyberattacks on the refrigeration and cooling systems of the Large Organized Retail (GDO) sector, affecting dozens of supermarkets across eight European countries, including Italy, the next target could be solar power plants, just as occurred in Poland a year ago.

Why the risk also extends to photovoltaic systems

By the end of 2025, Italy had over 2 million connected photovoltaic systems with a total capacity of approximately 43.5 GW, the majority of which are managed remotely via data loggers, gateways, and cloud platforms provided by manufacturers. The installed base includes systems from the Feed-in Tariff program (2010–2013) equipped with communication devices that are no longer supported.

These photovoltaic systems share the same OT risk profile as the Danfoss controllers, the Danish company that owns the majority of the refrigeration units recently targeted in an attack that forced remote defrosting, raising temperatures to as high as 50 °C.

support (AK-SM 800, AK-SC 355) or AK-SM 800A with outdated firmware, directly exposed to the internet.

The new factor

On October 13, Claroty Team82 demonstrated that an AI coding agent (Claude Sonnet 4.6 via Cursor), starting from common public vulnerabilities and exposures and the firmware downloadable from the manufacturer’s website, reproduced the vulnerabilities and achieved root command execution on a laboratory device in approximately 28 minutes and for $6, with human supervision. The window between disclosure and exploitability is now measured in hours.

Why it concerns photovoltaics

According to the cyber intelligence analysis conducted by Wateronmars of Alex Orlowski, the inverters, dataloggers, gateways, and RTUs of the photovoltaic systems analyzed in Italy share the same risk profile (exposed interfaces, public firmware, rare patches, aging installed base) as the attacked refrigerators, with three specific aggravating factors: the manufacturer’s cloud as a control channel, unauthenticated Modbus/TCP, and unattended sites.

Therefore, Orlowski advises CISOs to conduct an exposure audit on all managed systems within 30 days, accompanied by a risk-ordered remediation list.

The cold chain, the situation in Italy

Danfoss forced the defrosting of refrigerated display cases in approximately 700 French supermarkets, with temperatures reaching up to 50 °C, resulting in discarded merchandise. A second wave affected seven European countries and, on November 2, at least four Coop stores in Sicily. However, attribution requires caution: major Italian retail chains have stated that they do not use the Danfoss technologies involved in the overseas incidents. For the Italian cases, the technical vector is not confirmed and should be treated as a hypothesis.

At present, the National Cybersecurity Agency, as stated on its website, has received a NIS incident notification from a Tuscany-based company operating in the collective catering sector; it has also detected, but not yet notified, an attack on an Emilia-Romagna-based frozen food production company. Given the widespread geographic distribution of the sector, the Agency has intensified all monitoring to identify any further potential attack cases and urges all operators in food distribution and the cold chain to activate urgent verification and mitigation measures.

Immediate actions indicated by ACN

What we have learned

"The decisive factor," Alex Orlowski comments to Cybersecurity Italia, "is the end-of-life status of devices and the lack of updates, before individual vulnerabilities and common exposures: without available patches, the only defense is the network."

"An OT asset reachable from the internet," he adds, "is attackable without breaching the organization's internal network. The effect is immediate, both physical and economic: goods, fires, shutdowns, waste."

"In the case of photovoltaics," Orlowski concludes, "the equivalent is lost production, damage to equipment and, at scale, grid instability."