Editorial illustration of electricity infrastructure and communications equipment; not a photograph of the affected Polish plant.
An investigation into Poland’s energy-sector cyberattacks reveals how a compromised renewable-energy connection became a pathway into another facility’s industrial controls—and why private communications networks cannot be assumed secure.
A power plant can be protected by firewalls, restricted remote access and specialized industrial networks.
Its control systems may not be directly accessible from the public internet.
Yet attackers can still reach those systems if another connected facility provides an unexpected route inside.
That is the central lesson from a cyberattack against Poland’s electricity infrastructure.
On December 29, 2025, coordinated destructive attacks targeted renewable-energy facilities and combined heat and power plants across the country.
The attacks were serious, but their consequences varied.
At more than 30 renewable-energy grid-connection points, attackers disrupted communications and remote-control capabilities without stopping electricity production.
At one combined heat and power plant, an attempted destructive malware operation was blocked by endpoint security software.
But another plant experienced a direct interruption of its industrial processes.
Its steam turbine and process-water treatment system shut down, interrupting the combined production of electricity and heat.
The facility’s operators responded quickly enough to prevent disruption of customer electricity and heat supplies.
Months later, investigators revealed how the attackers had reached the plant.
They had crossed through a private cellular communications network used by the electricity sector.
The finding raises a question with implications far beyond Poland.
If an industrial network is not directly exposed to the internet, how secure is it when its communications partners can become an indirect route inside?
A Coordinated Attack Against Energy Infrastructure
Poland’s national cybersecurity incident-response team, CERT Polska, published its first major report on the attacks in January 2026.
The investigation described coordinated activity against wind and solar installations, a large combined heat and power plant, and an industrial company.
The attackers’ objectives were destructive rather than simply focused on stealing information.
At renewable-energy facilities, they damaged or disabled remote terminal units and other equipment used for communications with distribution-system operators.
Those actions interfered with operational visibility and remote control.
However, the affected renewable facilities continued generating electricity.
That distinction matters.
A power plant may remain electrically productive even when its operator loses the ability to monitor or control certain equipment remotely.
Such a condition creates operational risk, but it is not the same as an immediate loss of generation.
At the large combined heat and power plant, attackers attempted to use destructive malware against internal systems.
According to CERT Polska, endpoint protection prevented the attempted malware operation from achieving its intended effect.
The campaign demonstrated that attackers were targeting not only conventional computer systems but also equipment supporting physical energy operations.
Yet the full scope of the incident was not initially known.
The Second Power Plant Nobody Had Publicly Accounted For
In August 2026, CERT Polska released a follow-up investigation revealing an additional attack against a smaller combined heat and power plant.
The facility supplied heat to approximately 50,000 residents.
At around 7 a.m. on December 29, attackers disrupted industrial control systems at the plant.
The incident caused the shutdown of a steam turbine and equipment used to treat process water.
Both were important to the facility’s cogeneration process.
Cogeneration plants produce electricity and useful heat from the same energy-conversion process.
Interrupting key equipment can therefore affect both forms of production.
In this case, the operators’ response limited the consequences.
The plant experienced a short-term operational interruption, but customers did not lose their electricity or heat supplies as a result of the attack.
Initially, the disruption was suspected to be associated with maintenance activity.
Investigators subsequently established that it was a cyberattack.
That finding is significant because a malicious industrial-control event can resemble an equipment fault or an operational error.
Without suitable records and investigation procedures, the underlying cause may not be immediately apparent.
The Unexpected Path Through a Wind Farm
The attackers did not begin by directly accessing the affected CHP plant from the internet.
Instead, the investigation traced their route through a compromised renewable-energy facility.
At the wind-farm connection point, a firewall and VPN device provided remote access to the local network.
A cellular router was also present.
That router supported communication with the distribution-system operator through a private access point name, or APN.
Private APNs are used to provide cellular data connectivity for defined groups of devices and services.
In electricity networks, they can support communications between remote substations, grid-connection equipment and control centers.
Such arrangements are attractive because many electricity assets are geographically dispersed.
A remote renewable-energy facility may need dependable communications without the cost or complexity of constructing a dedicated physical communications link.
But a private APN is not automatically equivalent to an isolated industrial network.
Its security depends on how connected devices are permitted to communicate and how access to those devices is controlled.
In Poland, that distinction proved decisive.
When a Private Network Became a Bridge
CERT Polska’s investigation found that the attackers gained access to a cellular router at the compromised wind-farm site.
They used that position to reach the private APN environment.
A critical weakness was that the network configuration permitted communication between devices that should not necessarily have been able to reach one another.
The attackers could therefore investigate other systems connected through the same communications infrastructure.
Their activity eventually led them to a controller associated with the second CHP plant.
The device was a WAGO PFC200 programmable logic controller equipped with cellular connectivity.
Investigators found that its administrative interface was reachable through the private APN and that default administrative credentials had been configured.
Those conditions allowed the attackers to extend their access.
From the controller, they reached the CHP plant’s operational technology network.
The sequence illustrated a failure of security boundaries across several independently managed systems.
A compromised renewable-energy connection became a route into a shared communications environment.
That environment provided access to another facility’s device.
And that device became a gateway into industrial systems controlling physical equipment.
The attackers did not need to compromise the entire national electricity network to produce a physical effect.
They exploited a chain of access relationships between specific facilities and devices.
From Network Access to Physical Disruption
After entering the CHP plant’s operational network, the attackers conducted reconnaissance.
They examined reachable systems and interacted with industrial-control equipment.
CERT Polska documented activity involving Siemens programmable logic controllers and other industrial devices.
On December 29, the attackers used their access to interfere with plant operations.
According to statements collected from plant personnel, affected controllers were switched into STOP mode and protected against straightforward modification or restart.
The resulting shutdown of the steam turbine and process-water treatment equipment interrupted cogeneration.
Other network equipment was also reconfigured in ways that made it difficult to access or restore.
The attack therefore affected more than data availability.
It changed the operational state of equipment involved in a physical industrial process.
That is a defining distinction between many conventional cybersecurity incidents and attacks against operational technology.
In an office environment, a destructive cyberattack may disable computers, erase files or interrupt business applications.
In an industrial facility, interference with control systems can stop machinery, disrupt production and potentially affect essential services.
The consequences depend on the process, the equipment affected and the effectiveness of operational safeguards.
In Poland, those safeguards and the actions of plant personnel helped prevent customer supply interruptions.
Why This Was Not a National Grid Collapse
The Polish incident demonstrates a serious cyber-physical security failure.
It does not demonstrate that attackers collapsed Poland’s national electricity grid.
The documented effects were specific.
At renewable-energy facilities, communications and remote-control functions were disrupted while electricity production continued.
At the second CHP plant, the cogeneration process was interrupted, but customer electricity and heat supplies were maintained.
Those outcomes should not be understated.
Loss of remote control can complicate the management of distributed generation.
Damage to industrial controllers can delay restoration.
Compromise of equipment shared across facilities can create opportunities for further attacks.
But a technically accurate account must distinguish compromised operational equipment from widespread electricity-system instability.
The significance of this case lies in the attacker’s demonstrated ability to cross network boundaries and interfere with physical plant operations.
It does not require an exaggerated claim about a nationwide blackout.
The Security Assumption That Failed
The most important weakness identified by CERT Polska was not simply the presence of cellular communications.
It was the assumption that a private communications environment provided sufficient protection without additional controls.
A private APN can restrict how devices reach a mobile data service.
But if connected devices can communicate freely with one another, compromise of one endpoint may create opportunities to reach others.
That risk becomes more serious when administrative interfaces are accessible, default credentials remain in use, or industrial networks lack effective separation from communications gateways.
The Polish investigation exposed several such weaknesses operating together.
No single technical label fully explains the incident.
The failure involved remote access, device configuration, network reachability and the relationship between communications infrastructure and industrial controls.
For electricity utilities, the lesson is that network ownership and network trust are different questions.
A communications service may be private without every device on that service being trustworthy.
What This Means for Distributed Energy Resources
Modern electricity networks increasingly depend on remote and distributed equipment.
Wind farms and solar plants connect through substations equipped with automation and telecommunications systems.
Battery installations require monitoring and control.
Distribution networks use remote terminal units, intelligent electronic devices and communications gateways.
Many of these facilities are operated or maintained by different organizations.
Their communications may depend on shared infrastructure.
That creates a challenge extending beyond any one utility.
An individual facility may maintain strong internal controls but still be exposed through a connected service or another participant in the communications network.
This is particularly important as the number of distributed energy resources grows.
The security of a grid-connected installation cannot be assessed solely by examining its inverter, transformer or protection equipment.
Its communications architecture also matters.
Engineers need to understand which devices can communicate, which administrative services are reachable, and what could happen if one connected endpoint is compromised.
The objective is to prevent a local cybersecurity failure from becoming a pathway into another operational environment.
The Difference Between Connectivity and Trust
The Polish case suggests several practical principles for electricity-sector cybersecurity.
Private cellular networks should be evaluated according to their actual configuration, not simply their designation as private.
Communication between connected devices should be limited to what is operationally necessary.
Industrial-control environments should remain protected even if a communications gateway or external endpoint is compromised.
Administrative access to field equipment should be tightly controlled.
Default credentials and unnecessary management interfaces create avoidable exposure.
Monitoring should also extend to the boundaries between operational networks and external communications services.
These measures are not new concepts.
What makes the Polish investigation important is that it demonstrates the physical consequences of failing to apply them consistently across a connected electricity-sector environment.
The attack also highlights the importance of recovery planning.
Restoring damaged controllers can require reloading configurations and control logic.
In the Polish investigation, some equipment damage and recovery actions limited the forensic evidence available afterward.
Utilities therefore face two urgent requirements during a cyber incident: restore safe operation and preserve enough evidence to understand what happened.
Both matter for long-term reliability.
A Warning for the Global Electricity Industry
CERT Polska described the private-APN pathway as the first known real-world example of this particular attack method observed by its investigators.
The organization also reported that similar network configurations were common among the entities it surveyed in Poland.
It warned that comparable arrangements may exist internationally.
That does not establish that every private cellular network is vulnerable.
Nor does it mean that a similar attack would succeed against every electricity utility.
The relevant question is whether connected devices are properly isolated and whether compromise of one endpoint can provide access to another facility’s industrial systems.
This is a problem that can be investigated and tested.
Utilities can examine network architecture, verify access restrictions, review device configurations and evaluate the consequences of compromised communications endpoints.
For engineers, the larger lesson is about the changing boundaries of the electric power system.
Electrical networks have always connected facilities through transmission lines, transformers and substations.
Digital communications now create another set of connections.
Those connections support reliable operation, but they can also transmit risk between organizations and assets.
The Polish attack shows why both networks must be understood.
The New Reliability Boundary
The attack against Poland’s energy infrastructure did not produce the widespread electricity outage its destructive intent might have suggested.
But it revealed a serious weakness.
An attacker who entered through one renewable-energy facility was able to exploit a shared communications environment, reach another plant’s industrial controls and interrupt a physical energy-production process.
The incident was contained before customers lost electricity or heat.
That outcome reflects the importance of operational response and resilience.
It does not erase the underlying security failure.
As power systems become more distributed, automated and digitally connected, the security of individual facilities will increasingly depend on the systems to which they are connected.
A substation may be electrically isolated from a disturbance yet exposed through communications.
A power plant may have no direct internet-facing control system yet remain reachable through a trusted network partner.
A private network may provide useful connectivity without providing the security separation its users assume.
The lesson from Poland is not that electricity networks should stop communicating.
It is that every communication pathway capable of reaching critical operational equipment must be treated as part of the grid’s reliability architecture.
In an increasingly digital power system, protecting the flow of information is becoming inseparable from protecting the flow of electricity.