Spain tops European list of internet-exposed solar systems: one in three located here

Spain tops the European list of solar systems exposed on the internet: one in three is located here

Spain accounts for 2,766 systems linked to solar installations accessible from the internet, approximately one in three of those detected in Europe, according to a study by internet intelligence firm Modat. The research scanned solar and wind parks in 35 countries and found 8,547 systems exposed to the public network, many of which lack the protection they should have. The report was authored by Modat Magnify in collaboration with a researcher from the Netherlands’ national cybersecurity center, and was covered by EFE and Xataka.

It is important to clarify from the outset: exposed does not mean attacked. The study counts interfaces visible from the internet, not intrusions.

What exactly did they find?

Control panels for renewable energy facilities are accessible from the public internet, some without any password. According to EFE, Modat identified 7,942 solar farm systems and 605 wind systems that should not be accessible from the internet. Some are the management interface for a single turbine; others control multiple turbines, or an entire farm, from a single screen.

The severity varies. In many cases, only a page requesting a username and password appears. However, Modat founder Soufian El Yadmani explains to EFE that they found panels "without any type of authentication or protection," from which a system could be stopped, started, or restarted. The researchers reached industrial controllers that issue instructions to machinery, and one access page revealed that the default user was "root," the account with the highest permissions.

Why does Spain top the list?

Primarily, because of the size of its solar fleet. Yadmani attributes this to the volume of solar installations in Spain compared to other European countries, according to EFE. Xataka adds, citing Moncloa.com, other factors: the dispersion of suppliers, the turnover of technical staff, and the rapid growth of installed capacity. In total, Spain, Greece, Italy, and Germany account for 76% of the solar systems found; in wind, Germany and Italy together represent 67%.

One figure puts the numbers in context: renewables generated 54% of the EU's electricity in the second quarter of 2026, according to Eurostat, and Spain is a solar powerhouse. More installations means, almost by definition, more surface area to monitor.

What real risk does this pose?

The risk of someone remotely shutting down facilities that power the grid. The study itself emphasizes that the 2,766 exposed Spanish systems do not equate to 2,766 cyberattacks. However, El Yadmani warns that in a severe scenario where an attacker gains access to critical systems and takes them offline, the impact could affect an entire city or even a whole country. He also underscores a crucial point: in cases lacking authentication, “it is not even necessary to exploit a vulnerability.”

This connects to an issue we have previously reported: AI is facilitating attacks on critical infrastructure, such as the power grid. El Yadmani summarizes it thus: what Modat can map in hours, an attacker can do as well. Modat and the Dutch center recommend removing administrative interfaces from the internet, controlling access by external providers, and ensuring the ability to operate systems manually in the event of an incident.

Is the photo reliable, or should it be taken with a grain of salt?

The findings must be handled with caution for two reasons, both of which exacerbate rather than mitigate the issue. First, the 8,547 systems represent only those that Modat could confidently attribute to specific installations; additional systems likely exist but could not be linked due to a lack of information. Second, the report was published on October 6, and country-specific figures are available only in the full document, which requires completing a form to download. The data cited here were obtained from EFE, which interviewed the researcher.

My interpretation: the headline stating that “Spain leads” is factually accurate but misleading, as it rewards the country with the most extensive measurement coverage. What truly matters is not the ranking, but the fact that solar farm panels are accessible on the internet without password protection. This is not a problem unique to Spain; it is an issue within a sector that has grown rapidly, involves numerous different providers, and has connected equipment to the network without considering external visibility. The good news is that, in most cases, the solution is not complex: removing these interfaces from the public internet. The bad news is that, as with systems that no longer receive updates, no one fixes what they do not know is connected.