Are UK Home Batteries and Solar Inverters Secure?

A modern home solar and battery system is no longer simply a collection of electrical equipment attached to the wall. It may include a solar inverter, battery management system, energy meter, Wi-Fi connection, mobile application, manufacturer’s cloud service and a remote account used by the installer.

This connectivity is useful. It allows a householder to check solar generation, schedule battery charging, take advantage of time-of-use tariffs and receive warnings when equipment develops a fault.

It also creates cyber security risks that older, unconnected solar installations did not face.

Most reputable systems are designed with several layers of safety and security, and a criminal cannot normally cause a dangerous battery failure simply by discovering a Wi-Fi password. Nevertheless, weak cloud accounts, abandoned installer access, unsupported firmware and poorly protected home networks can expose household energy equipment to unauthorised access.

The practical answer is therefore that UK home batteries and solar inverters can be secure, but their security depends on much more than the equipment’s electrical specification. The manufacturer, installer, cloud platform, mobile application and homeowner all play a part.

What Part of a Home Solar System Could Be Hacked?

The solar panels on a roof are usually passive electrical components. They generate direct-current electricity when exposed to daylight but do not ordinarily have their own internet accounts, Wi-Fi connections or remotely accessible software.

The more significant digital component is the inverter.

The inverter converts the direct-current electricity produced by the panels into alternating-current electricity suitable for use in the home or export to the electricity network. Modern inverters may also monitor generation, communicate with smart meters, control battery charging and send performance information to a manufacturer’s cloud platform.

As Can Solar Panels Be Hacked? explains, talking about “hacking solar panels” is usually an oversimplification. An attacker is more likely to target the equipment and services surrounding the panels.

Potential attack points include:

• The householder’s mobile application
• The manufacturer’s cloud platform
• The inverter’s local web interface
• A Wi-Fi or Ethernet connection
• Bluetooth commissioning functions
• The battery management system
• An installer or maintenance account
• Third-party energy-management software
• Connections to an electricity tariff or virtual power plant
• An application programming interface, commonly called an API

A vulnerability in any one component does not automatically give an attacker complete control of the installation. The level of access depends on how the system has been designed and which commands the affected component is permitted to issue.

As Can Solar Panels Be Hacked? explains, the panels on the roof are rarely the main cyber-security concern; the greater risk usually lies in the connected inverter, monitoring platform and remote-management account.

Why Home Energy Equipment Is Connected to the Internet

Performance monitoring

Manufacturers use cloud platforms to show how much electricity the panels are generating, how full the battery is and how much power is being imported from or exported to the grid.

Without remote monitoring, a fault could remain unnoticed for weeks. A failed inverter may not produce an obvious sign inside the home, particularly when mains electricity continues to operate normally.

Battery scheduling

A connected battery can be programmed to charge during a cheap overnight tariff and discharge when electricity is more expensive. Some systems also use weather forecasts and predicted household consumption to decide when energy should be stored.

These functions require data to move between the battery, inverter, mobile application and cloud service.

Remote diagnosis and maintenance

An installer or manufacturer may be able to inspect error codes, change configuration settings and install firmware without visiting the property.

This can reduce maintenance costs and restore service more quickly. However, every remote maintenance route must be controlled carefully. An unused but still active installer account can become an enduring back door into the system.

Grid and tariff services

Some home batteries participate in flexibility schemes or virtual power plants. Hundreds or thousands of individual batteries can be instructed to charge or discharge in response to electricity prices or grid conditions.

This can benefit consumers and help balance the electricity network. It also means that the security of the central control platform becomes important. A compromised platform could potentially affect many installations simultaneously rather than one home at a time.

How Secure Are the Mobile Apps?

The mobile application is often the homeowner’s main route into the system. It may reveal live electricity consumption, battery charge levels, operating schedules and historical generation.

Depending on the manufacturer, it may also allow the user to change battery modes, reserve levels or charging times.

Password reuse creates an avoidable risk

If a homeowner uses the same password for their inverter account and another website, a data breach elsewhere could expose the account. Criminals routinely test previously stolen email addresses and passwords against unrelated online services.

A unique password is therefore essential. The UK National Cyber Security Centre recommends creating strong passwords and enabling two-step verification where it is available.

Two-step verification makes account takeover considerably harder because possession of the password alone is not enough to sign in. Unfortunately, it is not yet offered consistently across every residential energy platform.

The email account matters too

Password-reset messages will usually be sent to the email address registered with the manufacturer. If that email account is compromised, an attacker may be able to reset the energy account’s password.

The email account connected to a solar or battery system should therefore have a unique password and two-step verification of its own.

Phones can retain access

A lost or stolen phone may still contain an authenticated manufacturer application. Homeowners should use a screen lock, keep the phone updated and remove access from old devices where the manufacturer provides an account-management page.

When selling a phone, it should be securely erased rather than simply handed to its new owner after applications have been deleted.

What Could Someone Do With a Compromised Cloud Account?

The consequences vary significantly between products.

At the lower end, an intruder might only be able to view generation statistics. Even that information may have privacy implications. A detailed household consumption graph can sometimes indicate when people are at home, when the property is normally empty and when high-powered appliances are being used.

A more capable account might allow changes to:

• Battery charging and discharging schedules
• Minimum backup reserve levels
• Import or export preferences
• Time-of-use tariff settings
• Notification details
• Device names and property information
• Connections to third-party services

Changing these settings might increase electricity costs, reduce the amount of backup energy available during a power cut or prevent the homeowner from receiving fault notifications.

Some systems permit deeper operational control through installer or manufacturer accounts. These privileged accounts are more sensitive than an ordinary customer login because they may allow changes to commissioning values, grid settings or firmware.

However, it would be misleading to suggest that compromising an app automatically allows a criminal to make a battery explode. Reputable battery systems incorporate local protection mechanisms for voltage, current, temperature and state of charge. Electrical protection, inverter controls and the battery management system should continue to enforce safe operating limits.

Cyber security and physical safety are nevertheless connected. A serious vulnerability affecting privileged controls could interfere with availability, performance or protective operation. That is why manufacturers must treat remotely managed energy equipment as cyber-physical technology rather than as a simple household gadget.

Is the Home Wi-Fi Network the Weak Point?

It can be.

An inverter connected to the home router may be reachable by other devices on the same network. The risk depends on whether the inverter exposes a local administration page, uses insecure local communications or trusts commands from connected devices without adequate authentication.

The US Cybersecurity and Infrastructure Security Agency disclosed vulnerabilities in EG4 inverters in 2025 that could allow an attacker with local network access to intercept, manipulate, replay or forge data. This does not mean every inverter has the same weakness, but it demonstrates why local network security matters.

Protect the router

Homeowners should:

• Install router software updates when they are available
• Change a weak or reused router administration password
• Use WPA2 or WPA3 Wi-Fi encryption
• Disable remote router administration unless it is genuinely required
• Remove unknown connected devices
• Replace routers that no longer receive security updates
• Avoid sharing the main Wi-Fi password unnecessarily

The Wi-Fi password and the password used to administer the router should not be the same.

Consider a separate network

Some modern routers allow smart devices to be placed on a guest or Internet of Things network. This can restrict communication between the inverter and personal laptops, phones or home-working equipment.

This separation is helpful, but it must not prevent essential communication needed for monitoring or maintenance. The installer or manufacturer should be asked whether the system supports network separation before settings are changed.

Avoid exposing equipment directly to the internet

Port forwarding should not normally be required for a residential solar inverter or battery. It can expose a local administration interface directly to internet scanning and attack.

If an installer asks for router ports to be opened, the homeowner should request a written explanation of why this is necessary, which ports are involved, how access is authenticated and when the rule can be removed.

Firmware Support May Matter for 15 Years or More

Solar panels can remain productive for decades, while an inverter may be expected to operate for many years. The digital services surrounding the equipment may not have such a clearly defined life.

This creates an important question: will the manufacturer still provide cyber security updates long after the installation has been completed?

The National Cyber Security Centre advises consumers to avoid smart products that are already unsupported or approaching the end of support. Once a device is out of support, newly discovered vulnerabilities may remain uncorrected.

Since 29 April 2024, the UK Product Security and Telecommunications Infrastructure regime has required manufacturers of relevant consumer-connectable products to publish information about their minimum security-update period. It also requires unique or user-defined passwords and an accessible route for reporting security problems.

Whether a particular inverter, battery or associated gateway falls within the regime depends on the nature of the product and the applicable definitions and exclusions. Consumers should not assume that every component is covered in exactly the same way. They should ask for the product’s Statement of Compliance and its stated security-support end date.

Questions to ask before buying

Ask the installer or manufacturer:

• Until what date will this model receive security updates?
• Are updates installed automatically?
• Can critical updates be delayed or refused?
• What happens if the manufacturer’s cloud service closes?
• Can the system continue operating locally without the cloud?
• Is two-step verification available?
• Is there a published security-vulnerability reporting process?
• Will replacement parts remain compatible with the installed system?
• Who owns the data produced by the system?
• Can the system be transferred securely to a new homeowner?

A vague promise of “ongoing support” is not as useful as a clearly stated minimum support date.

Installer Access Is Often Overlooked

Installers need elevated access when commissioning a battery or inverter. They may have to enter grid-protection settings, associate the equipment with a cloud account and test how the system behaves.

The security problem arises when that access is not reviewed after installation.

The same third-party access problem exists on a much larger scale at commercial installations, as examined in Are Battery Storage Sites Vulnerable to Cyber Threats?

Shared installer passwords

A poor implementation might use the same installer password across numerous properties. If that password becomes known, multiple installations could be placed at risk.

The homeowner should ask whether the installer credential is unique to the property and whether the password can be changed without affecting the warranty.

Installer accounts that never expire

An installer may retain access for future maintenance. That can be useful, but the homeowner should understand:

• Which company can access the system
• Which individual accounts have access
• What those accounts can change
• Whether access is logged
• Whether the homeowner can revoke it
• What happens if the installer ceases trading

If the original installer closes, is acquired or changes its IT provider, old credentials should not remain active indefinitely.

Remote support should require control

Ideally, a homeowner should be able to see which organisations have access and approve or remove them. Particularly sensitive maintenance actions may require fresh authentication or explicit customer authorisation.

Manufacturers should also restrict installer accounts to the systems they genuinely manage. One compromised contractor account should not provide unrestricted access to every installation on a global platform.

This is the domestic equivalent of the third-party access problem discussed in Are Battery Storage Sites Vulnerable to Cyber Threats?

Real-World Vulnerabilities Show That the Risk Is Not Theoretical

Security researchers and government agencies have found vulnerabilities in solar inverters, energy gateways and their associated communications.

The US Department of Energy explains that internet-connected solar inverters and control devices have a higher cyber risk than isolated operational technology. Its guidance recognises that attacks on grid-connected devices could have physical consequences, including loss of power and, in extreme circumstances, fire.

That statement should be interpreted carefully. It describes what could be possible when cyber-physical safeguards fail; it does not mean that an ordinary stolen app password is likely to start a fire.

In 2025, CISA published an advisory covering EG4 inverter vulnerabilities. The weaknesses included insufficiently protected communications on a local network. The manufacturer produced updates, illustrating why both disclosure processes and continuing firmware support are important.

Research into distributed energy resources has also identified wider concerns involving insecure APIs, weak authentication, hard-coded credentials, unencrypted communications and inadequate separation between ordinary users and privileged installers.

The lesson is not that all home solar systems are unsafe. It is that an inverter should be purchased like a long-lived connected computer attached to electrical infrastructure—not judged solely by its efficiency rating, warranty length or purchase price.

Could Hackers Switch Off Thousands of Home Batteries?

A single compromised household account would normally affect only that installation. The more significant national risk comes from concentration.

If a manufacturer manages hundreds of thousands of inverters through one cloud platform, a successful compromise of that platform could provide a route to many systems. The same concern applies to aggregators operating virtual power plants.

A coordinated change in the output of a sufficiently large group of devices could create an unexpected shift in electricity demand or generation. The actual grid effect would depend on the number of affected systems, their power ratings, their state of charge, network conditions and the response of electricity-system operators.

This does not mean an attacker could easily “switch off Britain” through household batteries. The UK electricity system has multiple layers of protection and balancing capability. Residential equipment is distributed across many manufacturers, networks and configurations.

Nevertheless, aggregated control deserves stronger protection than an ordinary consumer application. How Secure Are Renewable Energy Control Systems? examines why access controls, monitoring, software updates and incident-response arrangements matter when digital commands can influence physical energy assets.

The broader strategic implications are also covered by What the UK Energy Sector Cyber Security Strategy Means in Practice. As Britain becomes more dependent on distributed solar, batteries, electric vehicles and smart tariffs, household technology becomes part of the country’s wider energy-security picture.

What Happens if the Manufacturer’s Cloud Service Fails?

Cloud failure is not necessarily a cyber attack. Services can become unavailable because of software faults, expired certificates, network failures, maintenance errors or commercial closure.

A well-designed installation should continue performing essential local functions safely when its internet connection is lost. However, the homeowner may temporarily lose:

• Mobile monitoring
• Remote notifications
• Tariff optimisation
• Weather-based scheduling
• Installer diagnostics
• Virtual power plant participation
• Remote configuration

Before buying, consumers should ask whether the battery and inverter will continue operating without the manufacturer’s cloud and whether basic settings can be accessed locally.

An installation that becomes unusable when a cloud company disappears creates both a consumer-protection risk and an electronic-waste problem.

What About Foreign-Made Inverters?

A manufacturer’s country of origin is not, by itself, proof that its equipment is insecure. Security should be assessed through evidence: product architecture, independent testing, update commitments, vulnerability handling, access controls and supply-chain transparency.

However, the concentration of inverter manufacturing and cloud control in a small number of overseas suppliers has raised legitimate strategic concerns.

Reuters reported in 2025 that US energy officials were investigating undocumented communications equipment found in some foreign-manufactured inverters and battery-management systems. The report did not establish that every device from a particular country contained such equipment, and the manufacturers and Chinese authorities disputed suggestions of malicious intent.

For a UK homeowner, the more immediate questions are practical:

• Where is account and energy data stored?
• Which organisation controls the cloud platform?
• Can overseas support staff access the installation?
• Does the product use undocumented communications?
• Is there an independent security assessment?
• How quickly does the supplier correct vulnerabilities?
• What happens if political, regulatory or commercial changes interrupt the service?

Supply-chain risk is one reason Why Is Cyber Security Important for Renewable Energy? extends beyond large power stations. Millions of individually small devices can collectively become important infrastructure.

A Practical Home Battery and Inverter Security Checklist

Before installation

• Choose an established manufacturer with a published security-update period.
• Ask for the product’s UK Statement of Compliance where applicable.
• Confirm whether two-step verification is available.
• Ask how the system operates without internet or cloud access.
• Check whether security updates are automatic.
• Ask who will retain installer access.
• Avoid unsupported, second-hand connected equipment unless it can be securely reset and transferred.
• Check that the installer is using the correct UK-approved equipment and commissioning process.
• Request written details of all connected services and data sharing.

During installation

• Create the cloud account using your own email address.
• Use a unique password that is not shared with any other service.
• Enable two-step verification.
• Do not allow the installer to retain your personal password.
• Change any default local administration password.
• Record the inverter, battery and gateway model numbers.
• Record the firmware versions at handover.
• Ask the installer to demonstrate how access can be reviewed or revoked.
• Make sure no unnecessary router port forwarding has been configured.

After installation

• Keep the mobile application and phone operating system updated.
• Install inverter and battery firmware updates.
• Review authorised users and installer connections periodically.
• Check generation and battery behaviour for unexplained changes.
• Investigate unfamiliar login or password-reset messages.
• Retain invoices, serial numbers and support information.
• Remove access from old phones and former household members.
• Contact the manufacturer if the system stops receiving updates unexpectedly.

When moving home

A connected energy system must be transferred like a smart alarm or business IT account.

The seller should remove personal information, revoke access from old phones and transfer ownership through the manufacturer’s official process. The buyer should create new credentials rather than inherit the seller’s password.

Installer access should also be reviewed. A new owner may choose a different maintenance company, making the former contractor’s continued access unnecessary.

Warning Signs That Deserve Attention

Contact the installer or manufacturer if:

• Battery schedules change without explanation
• The system repeatedly enters an unfamiliar operating mode
• A new user or installer appears in the account
• Password-reset emails arrive unexpectedly
• The application reports a login from an unknown location
• Firmware updates repeatedly fail
• Remote monitoring stops while the internet remains operational
• The inverter begins broadcasting an unexpected Wi-Fi network
• The manufacturer cannot state when security support ends
• The installer requests permanent remote access without explaining why
• The system imports or exports electricity at unexpected times

What To Do if You Think the System Has Been Compromised

Do not dismantle, open or electrically isolate a battery unless you are qualified and the manufacturer’s safety instructions require it.

Instead:

• Change the cloud-account password using a trusted phone or computer.
• Enable two-step verification.
• Secure the connected email account.
• Sign out other sessions if the platform provides that option.
• Contact the manufacturer’s security or technical-support team.
• Contact the accredited installer.
• Record unusual settings, notifications and times before changing them.
• Check the router for unknown devices or configuration changes.
• Follow the manufacturer’s instructions before resetting equipment.
• Report fraud, extortion or criminal account access to Action Fraud.
• Report significant cyber incidents through the appropriate NCSC reporting route.

If the battery is overheating, smoking, swelling, making unusual noises or producing a strong smell, treat it as an electrical or fire-safety emergency rather than merely an IT problem. Move away, call 999 where necessary and follow the manufacturer’s emergency guidance.

Are UK Home Batteries and Solar Inverters Secure Overall?

A professionally installed system from a responsible manufacturer should present a manageable risk. The equipment will normally include electrical safety controls, while reputable suppliers provide authenticated accounts, encrypted communications and firmware updates.

The weakest point is often not the battery cell or solar panel. It is the surrounding digital ecosystem: a reused password, an unsupported router, a poorly secured cloud API, a forgotten installer account or a manufacturer that stops issuing updates long before the equipment reaches the end of its physical life.

Consumers should therefore include cyber security in the purchasing decision alongside capacity, efficiency, warranty, fire safety and price.

The key questions are simple:

• Who can access the system?
• What can they change?
• How is that access protected?
• How long will security updates continue?
• Will the equipment still work if the cloud service disappears?
• Can ownership and installer access be securely transferred?

Home batteries and solar inverters are becoming valuable components of Britain’s future electricity system. Keeping them secure is not only a matter of protecting one household’s electricity bill. As installations become more connected and increasingly coordinated, good security in the home contributes to the resilience of the wider energy network.

Reference Material and Research

• Smart Devices: Using Them Safely in Your Home — National Cyber Security Centre
• The UK Product Security and Telecommunications Infrastructure Product Security Regime — UK Government
• Product Security and Telecommunications Infrastructure Act 2022 — UK Legislation
• Solar Cybersecurity Basics — US Department of Energy
• Solar Integration: Inverters and Grid Services Basics — US Department of Energy
• Cybersecurity Considerations for Distributed Energy Resources on the US Electric Grid — US Department of Energy
• EG4 Electronics Inverter Security Advisory — US Cybersecurity and Infrastructure Security Agency
• Cyber Security for Consumer Internet of Things: Baseline Requirements — ETSI