Wind farms and solar parks are Europe’s most dispersed energy assets and, physically, its hardest target. Online, they tell a different story. By clustering internet-wide scan data, Modat Magnify identified 8,547 exposed systems it could confirm as part of solar parks and wind farms across 35 countries in the EU, EFTA, and EU candidate states. That is what has been attributed so far and more remains.
Hard to Hit, Easy to Find
In the second quarter of 2026, renewables generated 54% of the EU’s electricity, with solar and wind supplying most of it. Ukraine has shown why that matters: a decentralised grid of wind and solar holds up under drones, missiles and sabotage in a way large central plants cannot.
In cyberspace, dispersal offers no such protection. Every site that is reachable from the internet is just as close to an attacker as the next one. And AI now lets anyone map that attack surface in hours, defenders and attackers alike.
What We Found
Using Modat Magnify, we mapped every operating wind farm and solar park in the EU, EFTA and EU candidate countries. Then we looked for the systems behind them that anyone can reach from the internet. We found thousands of exposed assets that we could confirm belong to solar parks and wind farms, in almost every country we looked at. And that is only what we could attribute so far.
What these systems expose goes well beyond data. Some are the management interface of a single turbine. Others sit one level higher and control several turbines, or a whole farm, from one screen.
Physically, wind and sun are the hardest target we have. Digitally, they are fragmented, exposed and often unmonitored. The report shows how much we could see, and what it will take to see the rest.
Download the Full Report
The full research report, To See the Wind and the Sun, goes further than this post. It includes:
- How AI-driven clustering surfaces devices nobody knew to look for, and how one exposed device leads to a whole plant
- Maps of Europe’s energy landscape, from conventional plants to every operating wind farm and solar park
- Real-world examples of systems with full control over an entire wind farm, and what that means for Europe’s power supply
- How visibility is built, from mapping to attribution, and why it sits at the very start of incident response
- Why visibility is the foundation, and where outside visibility stops
- Practical steps you can take on your own today, and what the sector needs to do together
About This Research
To See the Wind and the Sun is Modat research by Soufian El Yadmani, written together with Bouke van Laethem, presented at The ONE Conference in The Hague on 6 October 2026. The research publishes aggregated figures per country only. Names of parks, operators, IP addresses and locations are not made public. We informed affected parties through their national CERTs.
Work With Us on the Findings
The report covers what we found. The data behind it can help close the gap, and we want it to reach the people who can act on it.
Operators, vendors and service providers. If you run, build or maintain solar parks or wind farms, we can help you understand what of yours is visible on the internet. That includes your own assets and those of the suppliers and partners you depend on.
National CERTs and CSIRTs. Many exposed systems still need to be traced to their owners and fixed. If you want to help with responsible disclosure in your country, we would like to share the relevant findings with you and coordinate notification of the organisations involved.
To request access to the data or to discuss disclosure, contact us.
About Modat
Modat is a European Internet Intelligence company helping organisations understand the intent behind internet infrastructure before it is weaponised. By continuously mapping, profiling and analysing internet-scale infrastructure, Modat turns fragmented data into trusted intelligence that helps security teams investigate threats faster, understand adversaries more deeply and prevent attacks before they occur. Built for both analysts and the agents they deploy, the Modat platform integrates with existing security workflows to provide the context, relationships and confidence needed to stay ahead. Governments, national CERTs, critical infrastructure operators, security companies and enterprises rely on Modat to make faster, better-informed security decisions. Learn more at modat.io.
