Remotely controlling solar panels on residential rooftops is alarmingly simple, according to Czech experts. The risk stems from Chinese components embedded within these systems, warn specialists from Mavian, a Czech company based near Brno that specializes in installation and servicing of electrical equipment.
“We can take control of any device from a specific Chinese manufacturer not only in Czechia but throughout Europe,” warns Mikuláš Staněk from Mavian. His colleague Jakub Procházka adds that the risk extends to electric vehicle chargers, heat pumps, and large battery storage systems – essentially any technology connected to both the distribution network and the internet.
The critical vulnerability lies in inverters – devices that convert direct current generated by photovoltaic panels into alternating current for the grid. These inverters, particularly those manufactured in China, allow remote access for maintenance and updates. The servers they connect to are also located in China.
Security experts emphasize that this vulnerability could lead to blackouts far more severe than the one that affected parts of Prague and other Czech regions on July 4th. “If an attacker disconnected a large number of photovoltaic systems, a blackout could last for several days,” they warn.
The National Cyber and Information Security Agency (NÚKIB) acknowledges the problem. “We have been in contact with electricity distribution and transmission system operators since February 2024 and are working together to find a solution,” said NÚKIB spokesperson Alžběta Dvořáková. However, the agency lacks authority over small photovoltaic inverters as they belong to end users in households.
Experts believe the issue requires coordination at the European Union level. “The solution could be a discussion at the European level aimed at ensuring the protection of EU countries as a whole,” stated a spokesperson for the Ministry of Industry and Trade. They emphasized that the EU’s internal market is interconnected, and protection against cyber threats transcends individual state boundaries.