Poland

December 29, 2025

Winds farms were not the only utility attacked this past December as a steam turbine and the process-water treatment system at a Polish combined heat and power (CHP) plant ended up shut down by attackers that gained entry via a private cellular network.
That attack came on the heels of the December Polish wind farm and large CHP plant hack, which destroyed equipment. A small CHP plant also fell victim to an attack and CERT Polska just released that information. The information on the attack became public during DEF CON in Las Vegas last week as Marcin Dudek, head of CERT Polska, presented details on the incident.
The plant in Poland supplies heat to 50,000 residents. The plant’s steam turbine and a water treatment system used to produce process water ended up shut down, interrupting the cogeneration process, in which electricity and heat generate simultaneously. Thanks to the prompt response of the CHP plant’s operators, the December 29 incident resulted only in a short-term outage and did not disrupt heat supplies to consumers.

August 10, 2025

A small hydropower plant near Tczew (in northern Poland, close to Gdańsk) was successfully breached in a cyberattack that disrupted its industrial control systems (ICS/OT).The attack disrupted the hydropower plant’s control systems, causing erratic turbine behavior, sudden stoppages, and periods of zero power output as attackers manipulated operational parameters. Unlike an earlier attempted breach in May 2025 (when the plant was offline and unaffected), the August incident was significant because it interfered with a functioning energy facility. There were no reported widespread blackouts in Poland due to this attack.

December 29, 2025

On 29–30 December 2025, Poland’s energy sector came under a coordinated cyberattack targeting critical infrastructure, including combined‑heat‑and‑power (CHP) plants and systems controlling renewable energy generation such as wind and solar farms. The attackers sought to disrupt operational control systems, potentially affecting energy distribution, grid stability, and heating supply in key regions during winter.

Polish cybersecurity teams, energy operators, and government incident response units successfully repelled the attacks, preventing any blackouts or significant service interruptions. The incident required rapid isolation of affected control systems, verification of operational integrity, and enhanced monitoring of the national energy grid. Authorities noted that if the attack had been successful, it could have impacted hundreds of thousands of households and industrial facilities, demonstrating the high risk posed by cyber intrusions against energy ICS/OT systems.

Officials and cybersecurity analysts highlighted that the attack pattern and infrastructure targets suggest Russian‑linked actors, consistent with a series of hybrid warfare campaigns aimed at destabilizing critical infrastructure in Poland and Eastern Europe. The December attack underscored the vulnerability of energy networks to coordinated cyber operations, the importance of robust ICS/OT security, and the need for real-time threat detection and rapid incident response.