Do not set weak passwords for your solar panels
Hackers are attracted to weak passwords like moths to flame. Imagine this: your password is weak enough to be hacked via brute-force attack, or already known because you haven’t reset the factory admin default.
In that case, it is a win-win for hackers who want to steal your data, as there is no need for advanced infostealer malware campaigns. However, when the case is “energy,” and the entry route is via solar panels installed on your rooftops, the price to pay increases.
Global shift and security gaps in solar power
The Global move for smart-energy production has added new security gaps to national power grids. German International Broadcaster “Deutsche Welle” (DW) talked with hackers who have revealed flaws in solar power plants and rooftop installations around the world.
DW has alerted that “hackers can easily access solar power plants due to weak passwords and vulnerable software, posing a significant threat to energy security.” Rooftop installations are the main concern because the “ transition to renewable energy relies on digital networks that can be targeted by hackers,” Mathis Richtmann, reporter at Deutsche Welle said.
Security gaps explained
In October 2024, Secura studied the cybersecurity danger to the solar power industry in the Netherlands. The report found 27 different cases where large-scale attacks of solar power panels could be executed.
Secura researchers described the attack as “disastrous,” involving “severe economic damage, physical damage and even damage to society itself, certainly if the secondary consequences of the cyberattacks are taken into consideration.” The report investigated every aspect, “small domestic rooftop installations” via SME and large-scale “solar farms.” Supply chain attacks, hardware hacking, and web portal attacks were also researched.
The Problem of Password with Solar Panel
DW talked to a U.S hacker Aditya Sood, who showed how easy it was to hack into a remote dashboard for a solar power plant in India’s Tamil Nadu region. “There it goes,” Aditya said, explaining how “People deploy their devices and forget to actually change default passwords”, or “they have configured very weak passwords.”
A German company that looked into the design of the solar control setup in the Tamil Nadu plant told Richtmann that “while it is technically possible for a customer to assign a weak password and provide open access to their network on the internet, we do not recommend this.” Sood agrees with the intent, but hackers with malicious aims will exploit this opportunity, he demonstrated.
How to be safe?
Takeaways? The answer is simple: change your password, immediately. And make it a strong one. Don’t depend on factory defaults, and never share your login details. A user might think “How is it a big deal? My rooftop solar panel is just a small part in a big machine,” but when attacked, the consequences will be severe.