How Many Times Have Solar and EV Charging Actually Been Hacked? A Real Incident Timeline
A sourced timeline of real cyberattacks on solar and EV charging infrastructure, from 800 hijacked monitoring devices to wiper malware at 30 substations.
How Many Times Have Solar and EV Charging Actually Been Hacked? A Real Incident Timeline
"OT security for solar and EV charging" sounds like a theoretical risk that hasn't materialized yet — until you line up the incidents that have actually happened over the past two to three years. Stolen money, cut-off access to charging stations, and real equipment destroyed at a substation.
This piece rounds up confirmed, sourced incidents to show that the risk covered in OT Security for Solar and EV Charging Infrastructure isn't a hypothetical.
SolarView Compact — 800 solar monitoring devices hijacked for bank fraud (2023–2024)
Attackers exploited CVE-2022-29303 (publicly disclosed in May 2022) in Contec's SolarView Compact devices (a Japanese industrial control electronics maker), hijacking an estimated 800 devices — a figure reported by Japanese media, not an officially confirmed count — across solar power facilities and using them as a base for bank account theft. Palo Alto Networks' Unit 42 documented active exploitation and a tie-in to the Mirai botnet in June 2023; the underlying vulnerability had already been public for a year by then, so Unit 42 reported the ongoing attacks rather than discovering the flaw itself. Contec issued a mitigation notice confirming the fixed firmware on July 18, 2023, then renewed its warning to operators on May 7, 2024 after further reports of attacks — a long gap between the fix being available and operators actually applying it, which is exactly why the attacks kept happening.
South Korean security firm S2W assessed the campaign as the work of a group it tracks as "Hacker CN" (which it says appears to be the group "Arsenal Depository"), a hacktivist group active against Japanese infrastructure — an analyst attribution, not a confirmed identity.
Ignitis ON — European EV charging users locked out, 20,000 records leaked (February 2024)
A group calling itself "Just Evil" claimed to have breached the control panel behind Ignitis ON, a service that helps EV owners charge their cars, cutting off real users' access to their charging stations and posting video as proof. Ignitis's own report confirms a breach affecting more than 20,000 customers and some employees — names, email/postal addresses, plate numbers, and RFID token codes were exposed, though Ignitis says payment details and personal access codes stayed secure. The attacker's further claims — leaked employee data, access keys, and charging-station firmware, plus a ransom demand — are reported by security researchers but not independently confirmed by Ignitis itself. (Read the technical breakdown of the OCPP weaknesses involved in EV Charging Security: The OCPP Gaps Most Stations Still Haven't Fixed.)
Polish wind and solar farms — wiper malware hits grid-connection substations at 30+ sites (December 2025)
Unlike other incidents that targeted inverters directly, this one deployed wiper malware — software built to destroy data, not steal it — against substation equipment, the interface point between generating sites and the main grid, at more than 30 wind and photovoltaic farms, per CERT Polska's own incident report. Jay Johnson, CTO of DERSec, put it plainly: "the inverters remained untouched. Instead, attackers deployed wiper malware against substation" infrastructure. Generation continued and there were no widespread blackouts, but CERT Polska also noted that the infrastructure used in the attack overlapped with a cluster it associates with Russian state activity — a signal that the target list isn't limited to inverters, and that this class of attack isn't always opportunistic hacktivism either.
What these incidents have in common
- Known, unpatched vulnerabilities did a lot of the damage — SolarView's flaw was public for a full year before operators actually applied the fix
- The gap between disclosure and real-world patching was long — nearly a year in the SolarView Compact case
- Sophistication varied — SolarView looks like opportunistic hacktivism, while the Polish substation attack shares infrastructure with a cluster CERT Polska associates with Russian state activity
- The Polish wiper attack is a different kind of warning — the target list isn't limited to inverters or payment systems, and destruction (not theft) was the goal
What you can actually do about it
A pattern across most of these incidents: the exploited flaw was already known before the attack happened. That means visibility — catching a device communicating in a way that deviates from its normal pattern — is the layer that catches these signals early. zcrOT monitors Modbus traffic (solar/battery) and telemetry signals passively, without sitting inline in a way that could disrupt real operations. See the full approach in OT Security for Solar and EV Charging Infrastructure.
If you manage solar or EV charging infrastructure and want to know whether your network shows any of the warning signs above, check the zcrOT pricing.
Get in touch
Want to know if the solar or EV charging infrastructure you manage carries risks like the ones above? Our team offers a free consultation.
Sources: CSO Online — Hijack of monitoring devices highlights cyber threat to solar power infrastructure, Unit 42 — IoT Under Siege (includes CVE-2022-29303 / SolarView Compact), pv magazine — Solar cyber threats expand, but inverters still stay in the crosshairs, CERT Polska — Incident report: energy sector 2025, CERT Polska — Follow-up report, August 2026