Dutch researchers cited by Reuters report that thousands of wind and solar power systems across Europe are exposed online. The findings have raised questions about how operators can protect increasingly connected energy infrastructure without disrupting the remote access needed to run it. Wind and solar parks are often unmanned and spread across wide areas. Grid operators, energy traders and maintenance contractors rely on remote connections to monitor equipment and manage operations. That connectivity is essential, but it also creates potential routes for attackers.[1]
In an expert comment, Thomas Plank, Tributech's chief executive, argues that operators should remove exposed interfaces from the public internet immediately. He warned that this would reduce one source of risk without addressing the wider security challenge posed by numerous remote connections. “Taking these interfaces offline reduces exposure,” Plank said. “It doesn’t change the fact that thousands of remote connections now reach into energy infrastructure,” Plank argued that energy operators must plan for the possibility that a remote connection could be compromised. They need ways to detect intrusion and confirm that the data guiding their control systems remains authentic.
He said many operators cannot independently verify whether control systems' information is genuine or has been altered while traveling through connected networks. If operators cannot trust the data they receive, they may struggle to distinguish legitimate instructions from manipulated information. “Operators have to assume those connections will eventually be compromised, and be able to tell when they are,” he said.
The concern extends beyond preventing unauthorized access. Even after securing public-facing interfaces, operators must assess how information moves between facilities, contractors, and control centers, and whether they can trust commands throughout that process. Plank described closing exposed ports as an urgent priority, with stronger assurance of operational data as the next step. Securing interfaces can limit attack opportunities, but it cannot, by itself, guarantee that information and commands exchanged across remote connections have not been tampered with.
The reported exposure highlights the challenge energy operators face as they modernize infrastructure, add connectivity, and consider new technologies such as artificial intelligence. These capabilities can support more efficient operations, but they also make it important to protect both system access and the integrity of the data they depend on.
The report’s findings and Plank’s comments point to a two-part task: reduce unnecessary internet exposure now and build the ability to verify trusted data and commands across distributed energy networks.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/exposed-renewables-raise-grid-security-concerns-9813.html
Comments