Madrid, 15 October 2026. Energy digitalisation requires protection of the systems that support service delivery. Modat research, reported by EL ESPAÑOL, EFE and pv magazine, identified 2,766 exposed solar systems in Spain. These systems are accessible from the internet; the findings do not establish that an intrusion occurred. [1–4]
Internet Security Auditors recommendations. Inventory assets and dependencies; remove unnecessary public exposure of administrative interfaces; segment corporate and industrial networks; strengthen remote access and restrict supplier permissions. Coordinate testing and changes with operations to preserve safety and availability. Practise response and restoration to assess service continuity. [5]
LPIC, Spain’s Law 8/2011, requires designated critical operators to maintain operator security plans and specific protection plans, as applicable. The published Protection and Resilience of Critical Entities Bill (LPREC, not in force) broadens the focus to risks, dependencies and restoration of essential services. Preparing requires coordination of physical, digital and operational security, distinguishing current obligations from regulatory developments. [6, 7, 9, 10]
Internet Security Auditors services. Applicability and gap assessments, risk and protection-plan consulting, cybersecurity audits and agreed penetration tests help prioritise improvements. Business continuity and recovery plans, exercises and remediation verification complete the work. Request an assessment to align protection and resilience through evidence and assigned responsibilities. [8]
Referencias
[1] EL ESPAÑOL–Invertia — Energy system exposure (14 October 2026)
https://www.elespanol.com/invertia/empresas/energia/20261014/disparan-ciberataques-infraestructuras-criticas-sector-energetico-espana-digitaliza-cualquier-dispositivo/1003744418844_0.amp.html
[2] EFE — Exposed solar systems identified in Europe (10 October 2026)
https://efe.com/euro-efe/2026-10-10/espana-sistemas-solares-internet-europa-seguridad/
[3] pv magazine — Research into solar and wind systems (7 October 2026)
https://www.pv-magazine.es/2026/10/07/miles-de-parques-fotovoltaicos-europeos-con-2-766-espanoles-estan-expuestos-a-ciberataques-en-internet-segun-investigadores/
[4] Modat — Original research: To See the Wind and the Sun (6 October 2026)
https://modat.io/blog/to-see-the-wind-and-the-sun/
[5] NIST — SP 800-82r3: operational technology security
https://csrc.nist.gov/pubs/sp/800/82/r3/final
[6] BOE — LPIC: Law 8/2011 of 28 April, consolidated text
https://www.boe.es/buscar/act.php?id=BOE-A-2011-7630
[7] Spanish Congress — LPREC bill, BOCG series A, 88-1 (27 March 2026)
https://www.congreso.es/public_oficiales/L15/CONG/BOCG/A/BOCG-15-A-88-1.PDF
[8] Internet Security Auditors — Security and continuity consulting
https://www.isecauditors.com/en/security-consulting
[9] BOE — Royal Decree 806/2026: dissolution of Parliament (6 October 2026)
https://www.boe.es/diario_boe/txt.php?id=BOE-A-2026-20742
[10] Spanish Congress — Standing Orders, Article 207: lapse of pending business
https://www.congreso.es/es/cem/tit13
