Is my business inverter or battery a cyber security risk?

Yes. Inverter cyber security is a real business risk: an inverter or battery is connected to a portal, an app and often its installer. Know who has access, give minimal rights, keep the devices off the office network and update the firmware. Our energy management system lets you decide who gets access.

Panels and battery work, the manager follows them in an app, the installer still has an account from the start-up. Then the IT partner asks for a NIS2 inventory, or a headline says inverters can be switched off from abroad.

Nobody can say who can log in. Yet remote access is not the enemy: in Kapellen the owner gets a phone alarm when the battery is full.

Why can an inverter or battery be a cyber security risk for a company?

As soon as it can be reached over a network, someone other than you can read it or send it commands. The inverter talks to a controller, the controller to a portal in the cloud, and the portal to apps on several phones.

Fluvius, the Flemish grid operator, names four risks for solar installations. A hacker can steal data such as your production figures, or switch off the inverter and disturb production. A hacked installation can be a springboard to other systems on the same network. The financial damage runs from lost production to the installation itself.

A battery switched off or wrongly set from a distance is missing when the grid fails. A production line on solar power then stops with it. A badly secured Wi-Fi dongle next to the accounting PCs is a side door into the office network.

In April 2025 a SolarPower Europe risk report found that over a dozen manufacturers control significantly more than 3 GW of installed solar capacity. A targeted compromise of 3 GW could have significant implications for Europe's power grid.

In December 2025, according to PV Tech, the EU's Economic Security Doctrine named solar inverters a high-risk dependency. One reason: one software update can reach millions of systems at once.

Have inverters and batteries really been hacked?

The clearest case in Europe is Poland. On 29 December 2025 attackers hit 30 wind and solar installations and a large combined heat and power plant. CERT Polska, the Polish national response team, calls it the first attack on the Polish energy sector with a purely destructive goal.

The attackers damaged controller firmware, deleted system files or ran wiper malware. Electricity production went on, says CERT Polska, but the communication with the grid operators and the remote control of the sites were cut.

A follow-up report from August 2026 describes a new attack route: a badly configured private mobile network (APN) that gave access to the operational network. CERT Polska calls that setup common in Poland and in other countries.

In May 2025 Reuters reported, citing two unnamed sources, undocumented communication devices in some inverters and batteries from Chinese suppliers.

US Department of Energy laboratories later analysed about 30 inverters. In two cases the communication differed from the documentation, classified as non-malicious and unintentional. The realistic risk is not a spy chip but an account, a password or a network path that nobody manages.

Who can switch off your inverter or battery from a distance?

Everyone with enough rights on an account, or a network path to the device, can in principle change settings or switch it off. For a business system that list is longer than most owners think.

• You and your staff, through the app or the portal.
• The installer, who often keeps an account after the start-up to help with faults.
• The manufacturer, when a remote support function is switched on.
• Your energy management or a third party you allowed to steer the system, for example for a dynamic contract or to limit injection.
• Anyone on the same local network, if the device accepts commands without a password.

Often a remote switch-off is wanted: to stop injection at negative prices, or limit it when the grid asks. Our article on limiting the injection of your solar panels explains when that matters. An energy management system for your business steers the battery all day.

The question is who can send remote commands, and whether you know it. Good systems split viewing from steering: in the Victron VRM portal you invite each user and decide who gets full control.

On the GX controller, access level "User" stops settings being changed by accident. Remote support access for Victron engineers can be switched on or off.

Does NIS2 apply to your company because of its solar panels or battery?

It can. The Centre for Cybersecurity Belgium (CCB) treats an organisation with grid-connected solar panels as an electricity producer, in the energy sector of NIS2.

The Belgian NIS2 law of 26 April 2024 has applied since 18 October 2024. It covers listed types of organisation from medium size. In general that is 50 employees or more, or an annual turnover and balance sheet above 10 million euro.

The Union of Cities and Municipalities of Wallonia (UVCW) summarised the CCB's answer in its FAQ of March 2026. The grid connection decides, not whether you actually inject power:

Source: UVCW, based on the CCB FAQ (version of March 2026). In May 2026 the UVCW added that the CCB sees no legal room to exempt small producers; discussions on that point continue at European level.

For these producers the CCB accepts that the "Basic" level of its CyberFundamentals framework can be enough, because the impact of small production is limited. The duties remain: register with the CCB, report significant incidents and take security measures.

Article 30 of the law lists those measures, including supply chain security with your direct suppliers, access policy, and multi-factor authentication where appropriate. Under article 31 the management body approves the measures and is liable for breaches.

Two more energy types in the law can matter with a battery or chargers. They are market participants offering aggregation, demand response or energy storage services, and operators of recharging points for end users.

What do the new EU product rules change for inverters and batteries?

New rules make manufacturers responsible for basic security, but only for products sold from now on: your existing installation stays as it is.

• Since August 2025 the Radio Equipment Directive cybersecurity rules (Delegated Regulation 2022/30) cover certain internet-connected wireless devices, such as the Wi-Fi or mobile modules many inverters use. Goal: better cybersecurity, personal data protection and privacy.
• The Cyber Resilience Act entered into force on 10 December 2024. Manufacturers must report vulnerabilities from 11 September 2026. The main obligations apply from 11 December 2027: security across design, development and maintenance of connected products, and vulnerability management for their lifetime.
• More may follow. In January 2026, according to Solar Magazine, the European Commission proposed a revised Cybersecurity Act: member states would have to break ties with high-risk ICT suppliers from third countries in critical sectors such as energy. Lithuania already lets its grid operators disconnect solar plants above 100 kW that do not meet its cybersecurity rules.

How do you secure remote access to an inverter or battery?

Secure the access, not only the device: know every account, give minimal rights, separate the network and keep the firmware current. Seven steps cover most of the risk:

Should you just disconnect your inverter from the internet? In most business cases, no: nobody watches a disconnected system. No alarm when the battery fails, no firmware updates, and the installer cannot look before driving out.

The middle way: a Victron system is monitored and controlled locally on your own network, as well as through the VRM app and portal. That limits what goes out to the internet without going blind.

What should you ask your installer about cybersecurity?

Ask these questions before you sign, and again at the handover. The answers belong in your file, and for a NIS2 organisation in your supply chain record.

Comparing several offers? Our article on how to compare quotes for a business battery lists the other questions to ask. The one on which inverter a business needs explains the devices themselves.