A reported cyberattack on networked refrigeration systems in French supermarkets, as *Die Zeit* reported a few days ago, illustrates the potential consequences of inadequately protected control systems. For Tim Stephan Schulze, similar vulnerabilities in the photovoltaic industry also pose a serious risk.

„There’s nothing new about this incident. It illustrates a pattern that affects many industries: networked control systems that were set up once and then forgotten,“ explains Schulze.

Forgotten Remote Access Accounts as a Point of Entry

Solar parks are connected to plant operators, manufacturers, and monitoring service providers through numerous interfaces. The situation becomes critical when control functions can also be accessed through these connections or when remote access established during the construction phase remains in place permanently.

„Many parks have an access point that no one really needs. They leave it open because they might want to install an update at some point. It is precisely this inconspicuous access point that serves as the gateway.“

Attackers could exploit such vulnerabilities to manipulate systems, restrict their controllability, or misuse compromised systems for further cyberattacks. If numerous systems are attacked simultaneously, this could also pose risks to the energy infrastructure.

Network architecture determines security

Schulze recommends that operators document all components and access permissions, update outdated firmware, and consistently disable any remote connections that are not needed.

Network architecture is particularly important. Instead of making management and control systems directly accessible via the Internet, solar parks should establish their own encrypted VPN connection to a secure central gateway. Remote access is then granted exclusively through authorized access points.

Regularly checking open interfaces, software versions, and access credentials is also essential. One-time security audits or certifications cannot replace continuous technical monitoring.

Cybersecurity is also becoming increasingly important from an economic perspective

In addition to the immediate security risks, inadequately protected facilities could also become a greater focus in the financing of solar projects in the future. This is because potential operational disruptions, lost revenue, and restoration costs are also relevant to investors and financing banks.

Schulze therefore believes it makes sense to give greater consideration to cybersecurity in the technical and economic risk assessments of photovoltaic projects going forward.

„A single facility seems harmless. But many facilities operating at the same time constitute an attack on the energy infrastructure.“