Experts warn that hackers could exploit internet-connected solar inverters to disrupt electricity systems at scale as the EU’s installed capacity continues to surge.
Europe’s rapid solar expansion is creating a new kind of infrastructure risk. A report published in late September by a group of energy and cyber experts warns that smart inverters, the devices that convert solar panels’ direct current into grid-ready alternating current, could be abused by hackers to disrupt electricity systems at scale. The concern is not limited to individual rooftops or business premises. As more inverters connect to the internet for monitoring, configuration and software updates, a successful intrusion could affect the wider power network, not just a single installation.
The warning is rooted in the pace of growth in solar capacity. According to the report, the European Union’s installed solar base rose from 86 GW in 2015 to 406 GW in 2025, and could reach 718 GW by 2030. That scale matters because, in the experts’ view, a coordinated attack that switched a large number of inverters on or off at once could upset the balance between supply and demand, overload transmission lines and destabilise voltage. In the worst case, the report says, the result could be a broader blackout. The authors compare the potential impact with the 3,000 MW of reserve capacity held by Europe’s continental grid to absorb sudden production losses.
The document, prepared by 11 specialists linked to bodies including SolarPower Europe, ENTSO-E and Germany’s federal cyber security agency, identifies three high-risk attack paths. One targets manufacturers’ online platforms, where owners and operators often manage output, settings and updates through cloud services. Another involves a supplier being compelled by a state to embed a hidden backdoor in its platform, firmware or components. The third focuses on large utility-scale plants, where an attacker could exploit remote access systems and move deeper into site networks after bypassing perimeter defences.
Recent events in France underline why the warning has drawn attention. In the nights of 11 and 12 October, hackers reportedly manipulated Danfoss refrigeration controllers used by supermarket chains including Intermarché, Magasins U and Leclerc, forcing repeated defrost cycles and pushing temperatures in some units as high as 50C. Reuters and other outlets said the incident affected hundreds of stores and caused spoilage and financial losses. Separate reporting by Le Monde showed that similar attacks also hit refrigeration systems using Dixell technology, reinforcing fears that once a connected industrial device is exposed, the consequences can spread quickly through commercial infrastructure.
The report argues that the same weaknesses could exist in the solar sector unless regulators and operators tighten controls. For large plants, it recommends that inverter communications be logged, encrypted and authenticated, with outbound connections restricted to approved servers in the EU or in countries offering equivalent safeguards. It also calls for local network access only, manual rather than automatic updates from manufacturers, and the use of qualified service providers. On regulation, the experts criticise the current EU Cyber Resilience Act for allowing manufacturers to declare compliance themselves without independent testing or audit, and they argue for a dedicated solar-specific standard, third-party oversight, patch deadlines and better installer training.
The wider message is that the security of solar installations now depends as much on identity and access management as on hardware quality. The report says existing devices will not become safe simply because new rules arrive later. Operators, it argues, should catalogue every connected unit, verify that vendor support is still active, block inbound access wherever possible and route privileged maintenance through controlled management systems. In a power system increasingly shaped by distributed generation, the inverter has become not just a technical component, but a potential point of systemic vulnerability.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
