Cyber Attack on Polish Solar Plants Highlights Vulnerabilities in Energy Infrastructure

In late December 2025, a cyber attack targeted several solar plants in Poland, affecting 30 renewable energy sites. The attackers deployed wiper malware against substation equipment, leaving solar inverters untouched. This incident revealed that attackers are increasingly targeting the broader ecosystem of distributed energy resources rather than just individual devices. Although the attack did not lead to widespread blackouts, it highlighted vulnerabilities in solar monitors, APIs, and mobile applications that communicate with solar equipment. Backhaul communication channels, such as SSH and HTTPS, are potential entry points for attackers, raising significant cybersecurity concerns. The incident underscores the need for improved security measures across the solar energy sector, as many systems still utilize unencrypted interfaces. Industry experts are calling for enhanced cybersecurity protocols to protect against similar threats in the future.

Key Points: • 30 solar energy sites in Poland were attacked with wiper malware targeting substation equipment. • Solar inverters remained untouched, indicating a shift in attack focus to broader energy systems. • Vulnerabilities exist in solar monitors and APIs, posing significant cybersecurity risks.