海牙，10月6日：荷兰研究人员周二警告称，欧洲数千个风能及太阳能发电场的管理系统直接连接互联网，这很可能使攻击者得以访问相关控制界面，进而关停风力涡轮机，增加蓄意破坏的风险。
THE HAGUE, Oct 6 : Thousands of administrative systems at wind and solar power parks in Europe are exposed to the internet, potentially giving attackers access to interfaces that can stop turbines and raising the risk of sabotage, Dutch researchers warned on Tuesday.
这些暴露在网上的系统既包括管理界面，也包括用于显示数据及执行控制操作的运行界面。
The exposed systems included administrative and interfaces as well as operational interfaces showing data and controls.
不过，来自网络扫描公司Modat的研究员苏菲安·埃尔·亚德马尼向路透社透露，研究小组认为在大约181个发电场中，攻击者完全有可能实现全面控制。
However, one of the researchers, Soufian El Yadmani, from internet-scanning company Modat, told Reuters that researchers believed full control would have been possible in the case of around 181 sites.
研究报告指出，某个风力涡轮机的网页上不仅显示实时运行数据，还设有“启动”“停机”及“重置”按钮，并标注了该涡轮机的地理位置。部分管理系统则可同时控制多台涡轮机乃至整个发电场。
One turbine's web page showed live data, "Start, Stop and Reset" buttons and the turbine's location, the research said. Some systems controlled several turbines or a whole farm.
报告强调：“我们能在数小时内完成系统测绘，攻击者同样也能做到。”研究人员敦促各运营方立即切断管理界面与互联网的连接。西班牙太阳能与德国风能行业风险最高此次研究结果发布之际，欧洲关键基础设施的安全问题正备受关注。自2022年俄乌冲突爆发以来，西方多国政府多次指责俄罗斯对欧洲基础设施实施蓄意破坏及网络攻击，而俄罗斯方面则予以否认。
"What we can map in hours, an attacker can map in hours too," the report said. The researchers urged operators to take admin interfaces off the internet immediately. SPANISH SOLAR, GERMAN WIND MOST EXPOSED The findings come amid concerns about Europe's critical infrastructure, which has faced suspected sabotage and cyberattacks frequently attributed by Western governments to Russia since its invasion of Ukraine in 2022. Russia denies any involvement.
上个月，荷兰情报机构、警方及检察机关曾发出警告称，人工智能技术正在加速各类安全威胁的蔓延。
Last month, Dutch intelligence agencies, police and prosecutors warned that artificial intelligence was accelerating the threat.
周二，埃尔·亚德马尼与荷兰国家网络安全中心的布克·范·莱特姆在海牙举行的ONE大会上公布了上述研究成果。
El Yadmani and Bouke van Laethem of the Dutch National Cyber Security Centre presented their findings on Tuesday at the ONE Conference in The Hague.
埃尔·亚德马尼指出，那些与公共基础设施紧密相连的发电设施尤为值得警惕。“如果攻击者能够切断城市或机场的电力供应，试想一下这种行为在更大范围内会产生何种后果。”
Turbines or arrays closely linked to public infrastructure were a special concern, El Yadmani said. "If you can turn off the energy within the city or the airport, imagine that at a larger scale."
借助机器学习技术对数据进行分类与聚类分析后，二人共识别出8,547个本不应直接连接互联网的在线管理系统，这些系统分别隶属于分布在35个欧洲国家的7,942个太阳能发电场及605个风力发电场。调查发现，大多数被发现的系统均为带有操作界面的管理页面。
Using machine learning to sort and cluster data, the pair said they identified 8,547 internet-facing systems they could link to at specific solar parks (7,942) and wind farms (605) in 35 European countries, which should not have been exposed to the internet. Most of the systems found were admin pages with screens.
据称，西班牙存在漏洞的太阳能系统数量最多，达2,766个；希腊紧随其后，有1,860个。
Spain had the most exposed solar systems, with 2,766, followed by Greece with 1,860, they said.
德国拥有欧洲最高的太阳能装机容量，存在安全漏洞的太阳能系统数量为672个。不过，德国存在漏洞的风力发电系统数量也居欧洲首位，达212个；意大利紧随其后，有192个。研究人员指出，这一排名在一定程度上反映了他们能够将系统与具体地理位置相关联的能力。
Germany has Europe's most installed solar capacity, and 672 exposed solar systems. However it had the most exposed wind systems with 212, with Italy close behind at 192. The researchers said the rankings partly reflected where they had been able to link systems to specific sites.
欧盟网络安全局暂未对此发表评论。德国、意大利及西班牙当局也尚未对置评请求作出回应。
The European Union Agency for Cybersecurity could not immediately comment. Authorities in Germany, Italy and Spain did not immediately respond to requests for comment.
该报告引用的资料来源包括波兰网络安全团队CERT Polska对2025年12月发生的针对该国30个风电及太阳能设施攻击事件的分析，该事件正是潜在安全威胁的一个实例。
The report listed among its sources the Polish cybersecurity team CERT Polska's analysis of a December 2025 attack on 30 wind and solar sites in Poland, an example of the potential threat.