Thousands of Wind & Solar Park Systems Exposed on the Open Internet Across Europe
What Happened — Researchers from Modat and the Dutch NCSC identified 8,547 internet‑facing control systems at wind farms and solar parks in 35 European countries. Many of these expose login screens, turbine‑control dashboards and PLC interfaces that allow anyone with a browser to view live data or even issue “Stop” commands.
Why It Matters for Trust & Control Assurance
- The exposure directly tests the control objective of network segmentation and remote‑access restrictions – a core element of continuous control‑assurance programs.
- Without documented evidence that OT systems are isolated from public networks, organizations struggle to prove compliance with multiple frameworks (e.g., NIST CSF, ISO 27001).
- Verisq’s Control Mapping capability can automatically map discovered gaps to the relevant control objectives and generate audit‑ready evidence.
Who Is Affected – Renewable‑energy operators (wind and solar), OT device vendors, and any third‑party service providers managing these assets, primarily in Spain, Greece, Italy and Germany.
Recommended Actions
- Conduct a comprehensive OT asset inventory and tag any internet‑exposed endpoints.
- Enforce strict network segmentation: block public access to control‑system interfaces and require VPN or jump‑host mediation.
- Deploy continuous monitoring to detect any new internet‑facing OT assets and generate defensible audit evidence.
Source: Help Net Security
Technical Notes
- Exposure stems from misconfiguration rather than a known CVE; devices include Siemens ET 200SP PLCs and vendor‑specific turbine dashboards.
- Attack vector: public‑internet exposure via default credentials (e.g., “root”) and unsecured web interfaces.
Source: Help Net Security