Ethical hack: Solar panels can be hacked, damaging the grid

An ethical hack of solar panels in the Netherlands exposed their vulnerability to cyberattacks. This prompted calls from industry for stricter security assessments.

While wind turbines, which are highly interconnected and equipped with hundreds of sensors, have traditionally been considered more vulnerable to external interference than solar panels, a Dutch hacker has shown that solar panels are also vulnerable to certain types of attack. Euractiv reports.

Although we see renewables as a way to decentralise energy, their control can still be centrally linked through a shared cloud. That is the case at least in the Netherlands, where most residential and commercial solar installations are centrally managed via cloud platforms run by just a few companies.

These cloud-based management platforms could accidentally, following a cyberattack, or deliberately switch off all millions of solar panels at once.

"Devices that can be centrally coordinated or controlled (for example, aggregated rooftop solar installations) must be subject to an EU-approved or nationally approved monitoring layer," stressed Dries Acke, deputy director general of the lobbying group.

The Dutch case

That is exactly what a Dutch ethical hacker managed to do, gaining control of millions of smart solar panels, according to the investigative website FollowTheMoney.

The issue was already flagged in a 2023 report by a Dutch agency, which found that inverters—the basic components of solar panels that ensure electricity supplied to the grid meets its requirements and are usually connected to the web—can be “easily hacked, remotely disabled or used in DDoS attacks, one of the most common types of attack, which essentially seek to overwhelm a system.

In a statement responding to the cyberattack, EU industry association SolarPower Europe said the bloc “needs more robust cybersecurity rules for decentralised energy resources”.

Solar power’s share of Europe’s electricity grid rose from 1% in 2010 to 9% in 2023, and with it, the potential for cyberattacks on solar panels has also increased.

A vulnerable point

A 24 July report by the EU’s own cybersecurity agency found that the bloc is poorly prepared for a coordinated attack on its energy infrastructure, whether by a foreign state or by saboteurs.

Given the critical importance of electricity, any attack on Europe “attracts considerable preparatory activity from advanced threat actors” in the energy sector if their aim is to “carry out a destructive attack”, the report added.

Solar power plants were identified as a vulnerable point in several scenarios, partly because of the dominance of a single country, China, in the supply chain.

The industry says that although legislation such as the updated EU Network and Information Security Directive, known as NIS2, and the Cyber Resilience Act are a start, further measures are needed: solar resources should be classified as a critical element, which would subject them to stricter assessments.