A European Union report from the Smart Energy Expert Group warns that cybersecurity risks to solar power infrastructure are intensifying as solar deployment grows, with attackers potentially causing grid instability or wide-area outages by compromising solar inverters and their control portals.

The SEEG cautions that even small solar inverters can collectively impact the grid, and vulnerabilities in inverter control portals could enable attackers to disable gigawatts of capacity in a single strike.

Solar inverters, which connect to the internet for control and updates, create an attack surface that could allow disruption of large amounts of solar capacity via vulnerable control portals.

EU rules are seen as insufficient to cover this threat: the Cyber Resilience Act (CRA) and NIS2 largely address general cybersecurity or depend on product timelines, and NIS2 bases coverage on company size rather than remote-control capacity.

Under the CRA, devices face general cybersecurity requirements with self-assessment by manufacturers for products placed on the EU market after December 11, 2027, while NIS2 does not account for remotely controllable capacity regardless of company size.

Gaps exist in coverage for energy management providers, aggregators, and smaller firms, potentially leaving cloud-control ecosystems vulnerable to attacks.

Regarding firmware updates, manual or qualified-maintenance-provider-led updates are recommended over automatic updates for commercial, industrial, and utility-scale installations; for critical infrastructure, code reviews or reverse engineering should be considered to detect backdoors before updates.

Regulators identify three pathways to widespread device impact: remote mass updates or setting changes, exploitation of device or platform vulnerabilities, and state-driven coercion of manufacturers or service providers.

Supply chain risk management calls for restricting high-risk suppliers where backdoors pose serious risk, while recognizing market impact and the need for thorough risk assessments; the report does not name specific manufacturers.

EU and member-state policymakers, including SPD member Tiemo Wölken and Jens Geier, push for enhanced risk assessment, supplier screening, and excluding non-EU providers to safeguard energy security and grid resilience.

Isabel van der Leij stresses the need for secure devices and system-wide resilience as smarter energy devices bring benefits along with new risks.

Consumers should inquire about software updates, vulnerability reporting, data hosting, account security, offline controls, and strong authentication when buying home energy systems.