What has already happened
The events below are documented and publicly described. We cite them not to alarm, but because each shows a different, concrete mechanism, and each concerns a facility of the kind you are building or operating.
Poland, 29 December 2025
How it looked from the inside
In the course of a single day an attacker carried out destructive actions at no fewer than thirty Polish wind and solar farms and at a manufacturing company. The CERT Polska (NASK) report describes the character of those actions unambiguously: they were purely destructive, with no ransom demand and no theft for resale. The entry route was the same everywhere — an edge device acting as firewall and VPN concentrator, reachable from the whole internet and requiring no second authentication factor. Substation controllers held factory credentials, bay protection relays had an FTP service enabled by default, and operator stations used the default local administrator password set during deployment.
Same day, different outcome
The site that held
A combined heat and power plant attacked the same day had been penetrated more deeply than the farms: the attacker had been inside its network since spring 2025 and had exfiltrated the central account and password database. Lasting damage was nevertheless not done. Modern endpoint protection recognised the destructive process and blocked it on every machine at once. The difference between a site disabled and a site defended was not luck — it followed from decisions taken earlier, when the environment was being built and configured.
Germany, 2022
Three events in six weeks
On 24 February 2022 an attack on a satellite network disabled modems across Europe. A turbine manufacturer lost remote supervision of more than 5,800 wind turbines totalling roughly 11 GW — the turbines kept running in automatic mode, but for weeks there was no way to monitor or remotely regulate them. On 31 March a major turbine manufacturer detected an intrusion and pre-emptively shut down IT systems at many locations. Overnight on 11–12 April a service company operating wind farms suffered a targeted attack and within two days cut remote connections to some two thousand turbines.
United States, March 2019
An unpatched firewall and 500 MW without supervision
A renewable asset operator lost SCADA visibility over roughly 500 MW of wind and solar capacity across three states. There was no intrusion: the attacker exploited a known vulnerability in the web interface of network firewalls, causing them to reboot repeatedly. The official analysis identified a single cause — the vendor patch was available but had not been applied, because nobody was supervising the software currency of edge devices. This is the cheapest avoidable incident in the whole set, and also the most common.
Inverters and monitoring
Vulnerabilities are the rule, not the exception
In 2023 it emerged in Japan that around 800 devices monitoring photovoltaic installations from a single manufacturer had been taken over and used by criminals for their own purposes. In March 2025 a research team published an analysis of the photovoltaic systems of three large inverter manufacturers, describing 46 vulnerabilities — from hard-coded passwords, through takeover of the manufacturer's cloud account, to unauthenticated firmware update over the air. An inverter and a monitoring device are network-connected computers and demand the same discipline as a server.
The manufacturer's channel
A risk that requires no attacker
In November 2024 some inverters from one manufacturer were remotely disabled in several countries — not through an attack, but as a consequence of a distribution dispute between the manufacturer and its commercial partner. In May 2025 industry reports described the discovery, in some inverters and battery systems, of undocumented communication modules creating a channel alongside the one protected by the site firewall. Since 2025 Lithuania has restricted remote access to installations above 100 kW for entities from states deemed a security threat, and in April 2026 the European Commission restricted funding for projects using inverters from suppliers considered high risk.
All the events cited come from publicly available sources: CERT Polska (NASK) reports, company statements and annual reports, regulatory decisions, security researchers' publications and press coverage. This material is informational and does not constitute legal advice.