A method for computer-implemented identifying an unauthorized access to a wind farm where the wind farm comprises a number of wind turbines (11, 12, 13), a number of subsystems (120, 130, 201, 202) for controlling and/or monitoring the number of wind turbines (11, 12, 13) and a repository for storing wind farm data, wherein at each time point of one or more time points during the operation of the wind farm the following steps are performed: i) obtaining operational data of the wind farm from the repository, where the operational data (OH, OD) comprise technical data of the number of wind turbines (11, 12, 13) and the number of subsystems (120, 130, 201, 202) and organizational data (MTL, UI) indicating tasks to be dealt with in the wind farm in the future; ii) obtaining environmental data provided by the wind farm measuring device; iii) determining, for a predetermined time interval, a prediction of the operation and/or states of the wind farm by processing the operational data and the environmental data by a trained data driven model, where the operational data and the environmental data are fed as a digital input to the trained data driven model and the trained data driven model provides the prediction of the operation and/or states of the wind farm as a digital output; iv) obtaining operational conditions of the wind farm resulting from current or past user machine interactions of a user and one of the wind turbines (11, 12, 13) and/or the subsystems (120, 130, 201, 202), where the operational conditions are obtained within the predetermined time interval; and v) determining an unauthorized access to the wind farm by comparing the operational conditions with the prediction of the operation and/or states of the wind farm, the unauthorized access being characterized by a predetermined deviation of the obtained operational conditions from the prediction of the operation and/or states of the wind farm. i) obtaining operational data of the wind farm from the repository, where the operational data (OH, OD) comprise technical data of the number of wind turbines (11, 12, 13) and the number of subsystems (120, 130, 201, 202) and organizational data (MTL, UI) indicating tasks to be dealt with in the wind farm in the future; ii) obtaining environmental data provided by the wind farm measuring device; iii) determining, for a predetermined time interval, a prediction of the operation and/or states of the wind farm by processing the operational data and the environmental data by a trained data driven model, where the operational data and the environmental data are fed as a digital input to the trained data driven model and the trained data driven model provides the prediction of the operation and/or states of the wind farm as a digital output; iv) obtaining operational conditions of the wind farm resulting from current or past user machine interactions of a user and one of the wind turbines (11, 12, 13) and/or the subsystems (120, 130, 201, 202), where the operational conditions are obtained within the predetermined time interval; and v) determining an unauthorized access to the wind farm by comparing the operational conditions with the prediction of the operation and/or states of the wind farm, the unauthorized access being characterized by a predetermined deviation of the obtained operational conditions from the prediction of the operation and/or states of the wind farm.