The expansion of solar power in Lithuania continues to move closer to the country’s strategic goals. This summer, the number of prosumers exceeded 150,000. Growth since the beginning of the year has been more than 20 percent. However, the number of cyber incidents in recent years has grown even more aggressively. A recent U.S. study revealed vulnerabilities in software commonly used in solar power systems and reminded the international community of cyber incidents that have already taken place in Lithuania.
Last year, the National Cyber Security Center in Lithuania registered nearly 3,900 cyber incidents—63 percent more than the year before. One such case was the attempt by the hacker group “Just Evil” to gain access to solar power monitoring systems in Lithuania last autumn.
According to reports from “Ignitis Group,” the incident was minor and did not disrupt electricity generation. However, experts from the U.S. company “ForeScout” noted that this illustrates how solar power systems can become targets for hackers—particularly in Europe, where smart monitoring and control equipment is widespread, and where energy storage systems are increasingly being developed alongside power plants.
It is no coincidence that the “ForeScout” report highlighted severe power grid outages in Spain and Portugal earlier this April. The interruptions halted train services, disrupted airport operations, shut down mobile networks, internet, and payment systems, and caused numerous other problems. This unprecedented event on the Iberian Peninsula sparked broad debate, emphasizing that as the green energy transition advances, both grid infrastructure and security—including cybersecurity—must be urgently strengthened.
Warnings About Exploitable Equipment Vulnerabilities
Experts stress that many solar energy devices end up each year in households and small businesses, where cybersecurity standards are relatively low and experience in managing such risks is lacking. This means threats can emerge from virtually anywhere.
In May, the U.S. research team analyzed devices from 42 manufacturers and found as many as 35,000 cases where control interfaces were left unprotected. These included inverters, access points, data loggers, monitors, and other equipment. According to the report, manufacturers were informed about the vulnerabilities and risks identified during the research.
The study also covered products from major global manufacturers such as Huawei, Sungrow, Ginlong Solis, Growatt, GoodWe, and SMA. Components supplied by Sungrow, Growatt, and SMA stood out with the highest number of vulnerabilities—46 in total. According to “ForeScout” analysts, some of these weaknesses could allow hackers to take control of other smart devices within users’ homes. In large-scale attacks, such breaches pose risks to grid stability and the privacy of many users.
A frequently cited example is the cyberattack in Japan, where the target was the local manufacturer Contec’s remote monitoring system, SolarView Compact. Hackers compromised
800 devices in an attempt to gain access to users’ bank accounts. The company alerted its clients and urged them to update their software. Yet, a year later, cybersecurity experts found that several thousand SolarView Compact devices were still not properly secured.
Lithuania’s Ambitions Curtailed
Most popular solar power systems are designed and manufactured abroad. It is no secret that the market is dominated by Chinese producers and their products. According to the Ministry of Energy, Lithuania operates more than 1,000 solar and wind parks with capacities above 100 kW, as well as several battery systems of comparable size—some of which rely on Chinese-made, remotely controlled management systems. The lower price of Chinese technology was one of the key reasons for its widespread adoption in the market.
Acknowledging this, Lithuania abandoned the idea of a complete ban on the use of Chinese equipment in wind and solar parks. However, since May of this year, companies from China and other countries deemed a threat to national security have been barred from accessing the management systems of solar and wind parks and battery facilities with capacities above 100 kW, as well as from controlling them remotely.
Operators of power plants in Lithuania are now required to implement additional safeguards to ensure cybersecurity. The risk is clear: hostile states could exploit such equipment remotely to disrupt the operation and stability of the power system. It is worth noting that China is listed among the countries identified in Lithuania’s National Security Strategy as a threat to national security and national interests.
Protecting the Energy Sector – A Task of National Importance
Also in May this year, Reuters reported on an investigation revealing suspicious communication devices embedded in photovoltaic inverters manufactured in China and found in the United States. Information from the Department of Energy prompted U.S. and other governments to more seriously evaluate the potential impact of remotely disabling such inverters. It is not difficult to understand why the FBI, more than a year ago, issued a notice to U.S. energy companies warning about growing cyber threats to the renewable energy sector.
Recalling this warning, “ForeScout’s” research division, Vedere Labs, in its report, provided several key recommendations for managers and operators of solar and wind parks. For example, ensuring that inverter control interfaces are not accessible online. Risks can also be reduced through a proper software update strategy and ongoing maintenance entrusted to professionals—specialized firms with the necessary expertise.
Overall, the report’s authors send a clear warning to organizations: update monitoring and remote-control systems as soon as possible, and compile a list of those that, for whatever reason, cannot be updated. They suggest considering whether such outdated solutions should be removed and replaced with new ones.
Dr. Robertas Janickas, Chief Technology Officer at Inion Software