A router, a public IP address—and for years, no one pays it any mind. What sounds like a long-outdated IT practice is apparently still a reality in Europe's energy infrastructure.

How heise online As reported on October 9, 2026, security researchers have identified more than 8,500 publicly accessible management systems for solar and wind power plants in Europe. In Germany alone, 884 systems are affected. Some of the interfaces not only allow access to operational data but also enable interference with the plants’ control systems.

For Tim Stephan Schulze, CEO of OIT.One, these findings are primarily a reflection of years of neglect in securing critical infrastructure. Commenting on the heise online report, he says:

„What’s truly alarming about these figures is that we’re talking about a security issue that has been known for years and has long been technically preventable. Solar farms were often equipped with a router and a public IP address so that technicians could access them remotely. Once set up, these configurations often remained unchanged for years.”.

However, this specific problem can be avoided by using a different network architecture. At a Park Energy solar park, for example, we reconfigured remote access so that the management services are no longer directly accessible via the public Internet. Instead, the plant itself establishes an encrypted VPN connection to a central gateway. Technicians can only access the system through authorized channels.

You can think of it like a telephone system: A public phone number can generally be dialed from outside the network. An internal extension, on the other hand, can only be reached from within a secure network. The security measures for the solar park work on the same principle. Anyone who wants to access the system must first gain access to the network.

However, this is only the first step. In the long term, the goal is to also monitor the systems’ data traffic in a targeted manner. Which external services are allowed to communicate? Which connections are necessary? And how can unusual activity be detected early on?

We are also addressing these issues in the development of Mesh Intelligence. The goal is to centrally consolidate security information and network traffic monitoring, rather than treating each facility in isolation.

The actual security vulnerability often lies not in the system itself, but in the way it was connected to the Internet.“