The rapid expansion of solar power in Europe is also increasing the electricity system’s exposure to cybersecurity risks linked to internet-connected photovoltaic installations.
According to a new report from the Smart Energy Expert Group (SEEG) cybersecurity working group, EU photovoltaic capacity increased from 86 GW in 2015 to 406 GW in 2025 and could reach 718 GWdc by 2030. As more inverters and solar installations become remotely monitored, configured and updated, the risk of coordinated cyberattacks affecting large volumes of generation also increases.
The report warns that attackers able to control large numbers of installations simultaneously could cause supply-demand imbalances, grid congestion or voltage disturbances, which in the worst case could lead to widespread power outages.
The document, reflects the consensus of experts within the SEEG cybersecurity group, although it explicitly states that it does not represent the official position of the European Commission.
Three scenarios are classified as high risk
The analysis divides PV installations into four categories: plug-in residential systems below 0.8 kW, residential installations between 0.8 kW and 10 kW, commercial and industrial projects between 10 kW and 1 MW, and utility-scale plants above 1 MW.
The group identifies three high-risk scenarios.
The first involves attacks on manufacturer platforms, particularly relevant for residential, commercial and industrial installations. A vulnerability in a central platform could allow an attacker to gain simultaneous access to large numbers of connected inverters.
The second is the deliberate introduction of backdoors in platforms, hardware or firmware by a manufacturer acting under the influence of a nation-state actor. The report considers this risk relevant across all categories of installations assessed.
The third concerns attacks on utility-scale PV plants through local networks, including remote-access firewalls used for operation and maintenance.
Source: Report from the Smart Energy Expert Group (SEEG)
A coordinated attack could exceed available system reserves
The potential impact of a cyberattack depends directly on how much generation capacity an attacker is able to control.
The report uses the continental European synchronous area as a reference, where frequency containment reserves amount to around 3,000 MW. An attack capable of controlling more generation than that could have serious consequences for system operation.
Potential impacts include simultaneous disconnection of generation, congestion affecting lines and transformers, and voltage disturbances that could force system operators to disconnect generation or demand in order to keep the grid stable.
Stronger security requirements for PV inverters
Among its main recommendations, the group calls for manufacturers of internet-connected devices used in PV installations to implement robust vulnerability management processes, with clear and enforceable timelines for security patches.
It also recommends encouraging bug bounty programmes to support independent security research and identify vulnerabilities before they can be exploited.
For utility-scale installations, internet communications from inverters should be systematically controlled. Traffic should be documented, encrypted and authenticated, while outbound connections should be restricted to approved servers located in the EU or jurisdictions offering an equivalent level of security.
The report also recommends blocking inbound communications from outside local networks and strengthening authentication requirements for remote access.
Automatic firmware updates should be more tightly controlled
Firmware management is another central issue highlighted by the report.
For commercial, industrial and utility-scale installations, the group recommends replacing automatic firmware updates initiated directly by manufacturers with controlled manual updates carried out by qualified maintenance providers.
For critical infrastructure, it also suggests that firmware could be subject to code reviews or reverse engineering to identify potential backdoors before updates are installed.
Restrictions could apply to high-risk suppliers
The report also recommends that the use of certain components or software should be restricted where there is a serious risk that a supplier could deliberately introduce backdoors.
However, the experts warn that such measures could significantly affect the market if there is insufficient alternative supply. Any restrictions should therefore be based on a thorough risk assessment.
The report itself does not classify individual manufacturers or suppliers as high risk.
EU cybersecurity rules still leave regulatory gaps
The report also assesses how far existing European legislation can address these risks, including the Cyber Resilience Act, the NIS2 Directive, the Network Code on Cybersecurity and the Network Code on Requirements for Generators.
The experts conclude that the Cyber Resilience Act already applies to PV inverters, but that its current verification framework is not strong enough to enforce all recommended mitigation measures.
They therefore propose developing a harmonised European cybersecurity standard for PV inverters and classifying inverters as Class II important products, which would require independent conformity assessment by a notified body.
The group also recommends aligning thresholds under NIS2 and the Network Code on Cybersecurity, strengthening coverage of installers, and introducing verifiable minimum cybersecurity qualifications for professionals working on PV installations.
One of the main gaps identified concerns intentional backdoors in the supply chain, which the experts say are not adequately addressed by existing regulation.
Solar cybersecurity is becoming a system-operation issue
The report shows how cybersecurity in the photovoltaic sector is moving beyond the protection of individual devices.
With hundreds of gigawatts of solar capacity increasingly connected to digital platforms, aggregators and remote-control systems, a scalable vulnerability could become a system-level risk for electricity grid stability and operation.
For this reason, the group recommends that cyberattack scenarios involving PV generation also be incorporated into electricity system risk assessments, alongside preventive measures targeting manufacturers, operators, installers and asset owners.
