Cyber Threats Target Solar Infrastructure Beyond Inverters

• •A cyber attack in December 2025 affected 30 solar plants in Poland, targeting substation equipment.
• •Solar inverters can detect attacks at the firmware level, but operators lack visibility into these signals.
• •Vulnerabilities in solar monitoring devices and communication protocols pose significant cybersecurity risks.

In late December 2025, a cyber attack impacted 30 solar plants in Poland, primarily targeting substation equipment with wiper malware, while inverters remained unaffected. The attack highlighted vulnerabilities in the broader ecosystem of distributed energy resources, including solar monitors and APIs. Historical data indicates that while inverters are often seen as prime targets, attackers are exploiting backhaul communication channels like SSH and FTP. Concurrently, research from KAUST revealed that solar inverters can detect cyberattacks at the firmware level, but lack the necessary communication protocols to alert operators effectively. In 2024, approximately 800 solar monitoring devices in Japan were compromised, and in 2025, 46 vulnerabilities were disclosed across inverters from major manufacturers. The current threat landscape emphasizes the need for improved cybersecurity measures across all layers of solar infrastructure.