Eight Months Later: The Attack Inside Poland's Attack, and What Came Next- 311

August 12, 2026

For eight months, the operators of a small combined heat-and-power plant supplying roughly 50,000 Polish residents believed their Christmas-period equipment failure had been an ordinary contractor mistake. It was not. Poland's national CERT disclosed this month that the shutdown of the plant's steam turbine and water treatment system on December 29, 2025 — the same day a much larger, already-public campaign hit 30 wind and solar installations and a major heat plant elsewhere in the country — was in fact a second, previously unrecognized cyberattack, one that took a three-month forensic investigation to even confirm as malicious. Weeks after that disclosure, Poland's largest convenience store chain announced a completely unrelated breach of its own, traced to a compromised third-party contractor account. Neither incident shares a perpetrator, a motive, or a technique with the other, but together they suggest something Poland's own cybersecurity agency has started to say out loud: what has become public so far may be a fraction of a broader, still-unfolding pattern, and the country's own reporting culture — treating unexplained operational failures as worth investigating rather than dismissing — may be the main reason any of it has surfaced at all.

The original December 29 campaign is by now well documented. An attacker destroyed equipment beyond repair at 30 distributed energy sites and one large combined heat and power plant, disabling communications gear, corrupting operational technology devices, and wiping Windows systems in an operation a senior Polish minister said came "very close" to causing a blackout for nearly 500,000 people — though, in the end, energy generation and distribution were not actually disrupted. Poland's government formally attributed that campaign to Russia's Federal Security Service in July. ESET's independent technical analysis, based on a destructive wiper it calls DynoWiper, points toward a different conclusion with real but limited confidence: the malware's architecture and behavior show strong overlap with previous Sandworm-linked wiper activity, leading the firm to attribute the operation to the Russia-aligned Sandworm group at only medium confidence, while noting it saw no evidence any disruption actually succeeded. The two attributions — one governmental, pointing to the FSB, one technical, pointing to Sandworm with acknowledged uncertainty — are not necessarily incompatible, but they are not the same claim, and the distinction is worth preserving rather than collapsing into a single tidy sentence. Notably, the attack landed during peak winter demand and fell on the ten-year anniversary of Sandworm's 2015 attack on Ukraine's power grid, the first confirmed malware-induced blackout in history, which left roughly 230,000 people without power.

The second attack sat undiscovered inside that same day's chaos because nobody had reason to look for it. CERT Polska's head, Marcin Dudek, told the DEF CON security conference that the smaller CHP plant's operators initially blamed a contractor error for the shutdown of their steam turbine and water treatment system during what was supposed to be routine Christmas maintenance — a plausible, unremarkable explanation that would have closed the matter entirely if the timing hadn't lined up with the much larger, already-suspicious campaign elsewhere in the country. Because the disruption was caught and reversed quickly enough that customer heating was never actually interrupted, the incident was reported only for informational purposes, the lowest priority category available. CERT Polska investigated anyway, specifically because of that timing, and the resulting analysis took more than three months to complete — long enough that the agency's report states plainly that reporting "unexplained failures and operational disruptions," not just confirmed incidents, is what made the discovery possible at all, a standard the agency contrasts explicitly with the narrower reporting requirements set out under the EU's NIS2 directive.

What the investigation found was a genuinely novel attack path that CERT Polska says it has never previously observed in a real-world incident: a full pivot from compromised IT infrastructure into an operational technology network by way of a private cellular data network, the kind of dedicated mobile connection the energy industry has generally treated as trusted, walled-off infrastructure rather than something requiring the same scrutiny as internet-facing systems. 

The attackers began at a wind farm, where they had already compromised a FortiGate VPN and firewall appliance, and used a Teltonika cellular router on that network to tunnel into a private Access Point Name network managed by the regional distribution system operator — a network that, critically, lacked isolation between connected clients, letting the attackers scan for and reach devices at facilities with no operational relationship to the wind farm beyond sharing the same private network. Starting December 18, they found a WAGO PFC200 programmable logic controller at the CHP plant whose web interface was exposed on that network and still protected only by default administrator credentials, enabled SSH access on it, and used the controller as a bridge into the plant's OT network. Over the following week they mapped the environment, connecting to three Siemens PLCs on Christmas Day in what CERT Polska assesses as final preparation. Just before dawn on December 29, they accessed the SCADA interface and those Siemens controllers, switched them into STOP mode, locked operators out with new passwords, and shut down both the steam turbine and the process-water treatment system, breaking the cogeneration process. Plant staff began restoring systems roughly two hours later, while the attackers were reportedly still active, and limited the disruption to a brief outage with no impact on residents. One structural detail buried in the technical account explains how the misconfiguration existed in the first place without anyone intending it: the distribution operator's own rules required all communication between its network and the plant's remote terminal unit to run over a serial protocol, and that requirement was in fact met — but nobody had separately defined any rule for the cellular router's own administrative interface, which ended up wired with a second, entirely unmonitored Ethernet connection into a VLAN managed by the same central firewall the attackers had already compromised. The gap wasn't a broken control; it was a control nobody had thought to write.

Before leaving, the attackers worked to make reconstruction as difficult as possible, reconfiguring Moxa serial device servers and network switches to block legitimate access, destroying logs, and corrupting the WAGO controller so severely — CERT Polska says its partition table was damaged beyond recovery — that even a full factory reset couldn't bring the device back online, leaving investigators with no logs from that system at all. The only reason the attack could be reconstructed in this much detail is that one router in the chain happened to run older software that preserved its event logs through a factory reset, an accident of outdated firmware rather than any deliberate forensic safeguard. CERT Polska's warning is that none of this depended on an exotic vulnerability: the attackers used a reachable edge device, a private network already sitting in the path, weak or exposed administrative access, and enough patience to spend eleven days on reconnaissance before striking. The agency's surveys since the incident found this same lack-of-isolation misconfiguration common across Poland's energy sector at the time, and it believes similar arrangements are likely widespread internationally, which is precisely why a single small heat plant's Christmas maintenance failure has implications well beyond Poland's borders.

Weeks after that disclosure, Żabka, Poland's largest convenience store chain with more than 12,800 locations, confirmed a breach of a different character entirely. The company detected unauthorized access to the technical systems it uses to communicate with its franchise network, blocked it, and stated that payment systems, transaction data, its Żappka loyalty app, and day-to-day store operations were all unaffected — an assessment Poland's Minister of Digital Affairs, Krzysztof Gawkowski, said the government could confirm based on information it had received. The attackers had gained access not by breaching Żabka's own infrastructure directly, but by compromising the account of an unspecified external service provider, echoing the third-party-pivot structure of the CHP plant case even though the sector, the actor, and the objective are entirely unrelated. Disclosure here followed a distinctly different, faster path: rather than a months-long forensic investigation, the breach became public after unidentified hackers advertised what they claimed was stolen Żabka data for sale on a cybercrime forum for €5,000, and Polish outlet Niebezpiecznik reported that samples suggested the attackers had reached the company's Jira environment along with employee and contractor records, internal documentation, credentials, API keys, and source code from multiple GitLab repositories — claims Żabka has not confirmed. Niebezpiecznik also reported that the attackers contacted journalists and Żabka's business partners directly to publicize the breach before offering the data for sale, a reputational-pressure tactic that functions independently of whatever technical damage actually occurred.

Set beside each other, these two cases don't describe a single campaign, but they do describe a country where two very different intrusions — one a patient, technically sophisticated state-linked pivot through overlooked cellular infrastructure, the other an opportunistic criminal compromise of a vendor account — both ultimately trace back to a third party sitting just outside the victim's own direct control, and where the true nature of at least one incident stayed misdiagnosed as routine failure for the better part of a year. CERT Polska's own insistence that Poland treat unexplained operational disruptions as worth investigating, rather than filing them away as informational footnotes, is the reason the energy story surfaced at all — which raises an uncomfortable question its own report does not answer: how many other "contractor errors," in Poland or elsewhere, are still sitting exactly where this one sat for eight months, unexamined simply because nothing forced anyone to look.