In August 2026 a German security researcher found a flaw in iSolarCloud, the cloud platform that the Chinese inverter maker Sungrow uses to monitor and manage solar and battery systems. An inverter is the box that turns the direct current from solar panels or batteries into grid power, and today almost every one of them reports to a manufacturer's cloud. According to Sungrow's own advisory (SGSA-202608-0028, rated 9.2 out of 10, critical), someone who knew a user's email address could change part of the login request and get into that account without a password. The researcher, Marlon Starkloff of the Kassel firm Jakkaru, reported it on 22 August, and Sungrow fixed it on the platform itself on 25 August. Customers do not need to install anything.
Why it got attention. The German newspaper Die Zeit reported that the access the researcher reached covered user, management and administrator accounts, with about 250,000 Sungrow systems in Germany alone, totaling about 7.8 gigawatts of peak output, and at times about 18 gigawatts reachable across the platform. Experts quoted by Die Zeit warn that suddenly losing about 3 gigawatts can be enough to trigger blackouts. Sungrow says its logs show no one but the researcher used the flaw, and that firmware updates and device control need an extra password check and two-factor authentication, so mass changes to devices were not possible. The researcher told the German trade outlet ZfK that pushing a firmware update through the administrator interface would also have been possible. Germany's Federal Office for Information Security (BSI) said some of these cloud platforms now concentrate so much power that tampering with them through the cloud would be "system-critical." No attack was reported.
The regulation picture. This is where it matters for owners. German press points out that today inverters are not listed as important or critical products under the EU Cyber Resilience Act, and German critical infrastructure thresholds look at the size of each installation, not at how much capacity one manufacturer's cloud can reach. Germany's Federal Network Agency (Bundesnetzagentur) says the energy sector rules under the EU Network and Information Security directive (NIS2) will take effect no earlier than 2027. Meanwhile the European Commission has already acted on money. Under its guidance, EU-funded solar, wind and battery projects connected to the European grid must exclude inverters from high-risk suppliers, meaning companies in or controlled from China, Russia, Iran or North Korea. Projects already in the pipeline could keep a transition period only if they were notified by 1 May and put up for decision before 1 November 2026, and Euronews reported on 23 September that the Commission will not extend that 1 November date. Projects not tied to the EU grid must phase those inverters out by 15 April 2027. A revision of the EU Cybersecurity Act now in the European Parliament could later allow restrictions on high-risk suppliers across the market.
Who it affects. Developers and owners of EU-funded energy projects face the 1 November date directly. But any plant, water utility or manufacturer with solar panels or batteries on site, in any country, has the same hidden question: who can switch your inverters on or off from the internet, and through whose cloud?
Where this shows up from the plant floor to the cloud. At the field level, inverters and battery controllers sit on the roof, in the yard or next to the substation. They connect through a data logger or a cellular modem straight to the manufacturer's cloud, often installed by a solar contractor and never added to the plant's network drawings. In the control room, operators may see the solar output on a separate vendor web page rather than in the control system. In the cloud, the manufacturer, the installer and the owner may all hold accounts with the right to change settings or push firmware.
What the Red Tiger team recommends:
With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners find these vendor cloud connections with plant-safe methods, tighten the accounts and remote access around them, and write security requirements into energy project specifications.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources:
Sungrow security advisory SGSA-202608-0028, 10 October 2026: https://www.sungrowpower.com/en/login-bypass-vulnerability-in-sungrow-isolarcloud
Die Zeit (German), 7 October 2026: https://www.zeit.de/digital/2026-10/hackerangriff-solaranlagen-sicherheitsluecke-blackout-solarenergie
pv magazine, 8 October 2026: https://www.pv-magazine.com/2026/10/08/sungrow-patches-isolarcloud-vulnerability-after-security-researchers-gain-access/
ZfK (German), Sungrow vulnerability and regulation: https://www.zfk.de/digitalisierung/it/sungrow-sicherheitsluecke-solar-cloud
pv Europe, European Commission inverter funding guidance: https://www.pveurope.eu/inverter/eu-funding-closed-chinese-inverters-official-word-pending
Euronews, 23 September 2026: https://www.euronews.com/my-europe/2026/09/23/eu-commission-rejects-calls-to-delay-phase-out-of-chinese-power-inverters
Check out our resources and book a follow-up call with our team.
