At Enlit we’re on a mission to be the inclusive guide to the energy transition. All around the world. 365 days a year. Join us for the latest news, inspiring stories, insights, marketplace and virtual & live events.
A new report from the European Smart Energy Expert Group has found that coordinated attacks on PV systems could lead to widespread power outages
As Europe’s solar PV penetration grows rapidly – from 86GW in 2015 to 406GW in 2025 and projected to reach 718GW by 2030 – it is considered to present an increasing cybersecurity risk to the electricity system as these installations are now widely connected to the internet.
Should the installations be exploited, it could cause imbalances, congestion in the grid or voltage disturbances that, in the worst case, could lead to widespread power outages.
The risk is further exacerbated with serious vulnerabilities in inverters being discovered by security researchers, rising geopolitical tensions and the EU's heavy dependence on PV equipment of Chinese origin.
A new from the cybersecurity working group of the European Commission’s advisory Smart Energy Expert Group has identified three particularly serious risks.
These are:
Attacks on manufacturer platforms to which PV installations are connected, especially for residential, commercial and industrial installations.
Introduction of intentional backdoors in the central platform or in the inverter hardware or firmware by the manufacturer on behalf of a nation state actor, applicable to all use cases.
Attacks on utility-scale installations through local networks in which the threat actor gains access to a remote access firewall.
To address these issues, the working group recommends several mitigating measures, starting with manufacturers of internet-connected devices used in the installations being required to establish robust vulnerability handling processes for their cloud platforms, with clear and enforceable timelines for patching.
Also of interest
Bug bounty programmes should be encouraged to further incentivise independent security research.
The use of components and software from suppliers subject to the jurisdiction of third countries identified as posing significant cybersecurity risks also should be restricted, drawing on the criteria established in the proposed revised Cybersecurity Act.
For commercial, industrial and utility-scale installations, automatic firmware updates triggered by manufacturers should be replaced by controlled manual updates conducted by qualified maintenance providers.
For utility-scale installations, internet communication from inverters should be systematically controlled: all traffic should be documented, encrypted, and authenticated; outbound connections should be restricted to whitelisted servers located within the EU or under equivalent jurisdictions; and no inbound communications should be permitted from outside the local network.
The group also recommends that cyber attack scenarios on are incorporated into electricity system risk assessments conducted for instance under the risk preparedness regulation and the system operation guideline.
The working group also performed a legal gap analysis to determine how well existing EU legislation can be used to enforce mitigating measures against the cybersecurity risks.
A top finding is that the Cyber Resilience Act applies to inverters but does not provide strong enough verification to enforce the recommended mitigation measures. To strengthen the verification, a harmonised standard for PV inverters should be developed and inverters should be classified as important products, so that they must undergo an independent conformity assessment by a notified body.
Another finding is that the NIS2 directive and NCCS provide meaningful coverage for utility-scale producers and aggregators but the thresholds in these regulations should be aligned to make them easier to apply for competent authorities.
The NIS2 directive coverage also should be completed with the inclusion of PV installers alongside installers as managed service providers and PV installations owned by essential entities outside the electricity sector.
Another finding is that the Network Code on Requirements for Generators (RfG), which applies to all PV installations larger than 0.8kW, does not include cybersecurity requirements and its extension is recommended to require that the owners of installations use installers with verifiable minimum qualifications in cybersecurity.
The work group also notes that no existing regulation adequately addresses the risk of intentional backdoors in supply chains, particularly from manufacturers subject to the jurisdiction of countries identified as posing significant cybersecurity risks. This risk should be mitigated by restricting the use of high-risk suppliers through the revised Cybersecurity Act and the Industrial Accelerator Act and that these restrictions apply also to residential installations, including plug-in equipment.
Public understanding and trust need to become a more deliberate part of Europe's grid transition writes Tuuli Jevstignejev
Régis Hourdouillie, head of energy and utilities EMEA, Ericsson, debunks the myths around private wireless networks for utilities
The European Partnership for Solar Photovoltaics (EUPI-PV) has been formalised in an MoU between the European Technology & Innovation Platform for Photovoltaics (ETIP PV) and European Commission.
Sascha Zabransky says that Europe’s energy players are already working together but the biggest obstacles to the transition are now political
In response to the growing increase in energy demand in recent years, Siemens and Sarpel have taken a step forward in the construction of electrical substations.
Solar, wind, hydro and beyond – discover all the latest news, analysis and innovations from the world of renewables.
Volkswagen Poznań’s Crafter factory is now fully energy self-sufficient on sunny days, thanks to the completion of an 18.3MW solar power plant.
