Germany Warns Solar Operators: Cut Internet Access to Plant Controls

Germany's Federal Office for Information Security (BSI) is calling on operators of solar parks and other small power plants to remove every direct internet connection to their control systems. The guidance, published on October 13, 2026 under the reference BSI-CS 154, warns that industrial control equipment reachable from the public internet has become an easy target for attackers. It came only one day after a cyberattack disabled refrigeration units in hundreds of French supermarkets, an incident that showed how weak connected devices can disrupt a physical supply chain overnight.

The recommendation is aimed mainly at operators of small facilities, a group that often lacks in-house IT security staff. The BSI explicitly lists photovoltaic installations of all sizes, along with wind farms, hydropower stations, biogas units, waste-to-energy plants and food cooling systems. In a PV plant, the equipment concerned includes industrial controllers, communication devices, monitoring gateways, inverters, supervisory control and data acquisition (SCADA) systems and remote monitoring platforms.

The main measure is simple. Plant control systems should no longer be reachable directly from the internet. When remote access is truly needed, the BSI says it should go through a virtual private network (VPN) at a minimum, combined with strong passwords and, wherever possible, multifactor authentication. A VPN creates an encrypted tunnel between authorized users and the plant network, while multifactor authentication adds a second identity check on top of the password. The agency acknowledges that these steps do not remove all risk, but they make it much harder for attackers to get in with stolen or weak credentials.

Operators are also asked to install software and firmware updates quickly. This applies to supervisory systems as well as field devices such as routers, firewalls, controllers, inverters and communication gateways, because unpatched equipment stays open to flaws that vendors have already fixed. The BSI further recommends regular checks to find out whether any device is visible from the internet, along with a full inventory of connected assets and their communication interfaces. That inventory should include remote maintenance links set up by installers or service providers, some of which may run over separate mobile data connections the operator does not know about.

For PV plants (photovoltaic plant), the agency stresses the separation of office networks from operational networks, limiting remote access to approved users and service providers, and restricting outgoing connections to what is strictly necessary. It also asks operators to review whether permanent links to manufacturer clouds are really required for daily operation. Where possible, the BSI favors purely local operation and advises caution when buying products that cannot work without the vendor's online services. The agency describes its measures as easy to implement and wants them built into routine plant operations.

The stakes go beyond lost monitoring data. An attacker who reaches a control system could change operating parameters, stop production or hide the real state of the plant from its owner. In an earlier warning, the BSI noted that if a large number of installations were compromised at the same time, power generation and grid stability could also be affected. This matters in Germany, where solar output already exceeds demand on sunny days with low consumption and where millions of small rooftop systems feed the grid.

The October guidance is the latest step in a series of warnings. In June 2026, the BSI and the Federal Office for the Protection of the Constitution (BfV) reported that state-linked cyber actors, described as Russian in the official notice, were actively scanning PV systems connected to the internet without protection. The authorities found no confirmed compromise but said the activity could be preparation for later sabotage. They also made clear that dynamic IP addresses offer no real protection and that port forwarding on routers should not be used.

At the start of October, research by Dutch firm Modat and the Netherlands' National Cyber Security Centre identified 8,547 internet-facing systems at European solar parks and wind farms that should not be publicly accessible. Of these, 7,942 were found at solar sites in 34 countries, with a large share located in Spain, Germany, Greece and Italy. In the same week, German security firm Jakkaru disclosed a flaw in the iSolarCloud platform of Chinese inverter maker Sungrow that had allowed login to administrator accounts without a valid password. Sungrow says it patched the issue on August 25, three days after it was reported, and found no sign of abuse beyond the researcher's own tests. As of October 17, no confirmed attack on German power plants linked to these exposures had been reported.

The French incident gives a concrete picture of what can go wrong when connected equipment is left exposed. During the night of October 11 to 12, 2026, attackers took control of refrigeration controllers in supermarkets across France and forced them into a continuous defrost cycle, with temperature setpoints of up to 50°C (122°F). Stores operated by Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were affected, and estimates of the number of sites range from about 350 to around 500. Fresh and frozen products had to be thrown away, and some stores reported fire alarms or small fires. Two supermarkets in Alsace alone reported combined losses of about 270,000 euros, and total damage is expected to reach several million euros.

The Paris prosecutor's office opened a criminal investigation, and Prime Minister Sébastien Lecornu asked the national cybersecurity agency ANSSI to lead the technical response. Danish manufacturer Danfoss said most of the affected units were legacy products or devices running outdated firmware, including its AK-SM800 system managers, declared end-of-life in 2021, and AK-SC355 units phased out in 2016, which no longer receive security updates. Security researchers had published flaws in Danfoss controllers in August. One researcher counted 2,752 Danfoss systems reachable online on the day after the attack, including 1,590 in France. The chief executive of Coopérative U later said his group is not a Danfoss customer, so the exact entry path is still unclear. A week after the attack, no group has claimed responsibility and no ransom has been demanded.

The attack also has a German angle. An analyst at security firm Sekoia listed Germany, along with Spain, Portugal, Poland and Belgium, among the countries where similar devices remain exposed, although no confirmed incidents have been reported in Germany so far. BSI president Claudia Plattner said the French case shows how cyberattacks can disrupt daily life, warning that it could have hit any country and could inspire copycats at any time.

For supply chains, the lesson reaches well beyond solar power. Refrigeration controllers, building management systems, inverters, smart meters and industrial routers are now part of the operational backbone of retail, logistics and energy. Many of these devices were installed by contractors whose priority was functionality rather than security, and many remain online long after their makers stopped supporting them. When one vendor, integrator or cloud platform manages thousands of sites, a single weakness can hit them all at once. In food retail, the result is spoiled stock and empty shelves. In the power sector, coordinated manipulation of many small plants could swing grid output within minutes.

Artificial intelligence is now making these exposed devices easier to attack. On August 19, 2026, five US agencies including the NSA, CISA and the FBI warned that attackers were using AI coding assistants together with open-source automation libraries to build exploit scripts against internet-exposed Siemens S7 controllers in energy, water, food and manufacturing facilities. The agencies called it an active threat and said AI sharply reduces the skill and time needed to attack industrial systems. In tests reported in October, consulting firm Booz Allen found that advanced AI models met their objectives in all eight industrial attack scenarios it designed, in one case moving from a perimeter breach to actions inside a control network in just over 16 minutes. Palo Alto Networks reported that AI models completed a year's worth of manual penetration testing in three weeks.

Broader data points in the same direction. Check Point's 2026 report found that organizations faced an average of 1,968 cyberattacks per week in 2025, up 70% since 2023, with unmonitored edge and IoT devices increasingly used as entry points. Kaspersky also observed a sharp rise in AI-assisted attacks and more attacks on internet-exposed industrial equipment. Some limits remain, as simulations by the UK's AI Security Institute have so far shown models failing to hack industrial systems fully on their own. However, the main concern is speed. AI tools can locate exposed devices and turn known flaws into working attacks faster than small operators can apply patches, which is why the BSI puts removing direct internet access at the top of its list.

The BSI guidance is a recommendation rather than a legal requirement, and much of Germany's PV fleet belongs to households, energy cooperatives and small businesses. How quickly these owners and their installers act will determine how exposed the country's distributed power generation remains. Further developments to watch include the findings of the French investigation, possible copycat attacks elsewhere in Europe and pressure for EU-wide security rules covering inverters and other connected energy equipment.