Volume 2Energy edition2025Last verified 16 sources, 11 primaryAttributed by the UK with EU states
On 29 December 2025 an attacker disabled field devices at more than thirty Polish wind and solar farms and reached two heat and power plants. Generation continued, heat never stopped, and the UK and EU later named Russia’s FSB.
Distributed energy moves the perimeter. A coal plant has one fence. Thirty wind and solar farms have thirty firewalls and a telemetry network, run by someone else, tying each of them to the grid operator. On 29 December 2025 an attacker used that shape against itself: a remote login with no second factor, the passwords the devices shipped with, and a private mobile network that let one wind farm reach a heat plant.
None of that is exotic. What held was not the architecture. Generation carried on without its supervisory link, canary files stopped a wiper at the large heat plant, and operators at the smaller one restored a stopped turbine while the attacker was still inside. Heat never stopped. That the same intrusion against sites without those fallbacks would have ended differently is BlastWave’s analysis, and it is why the entry is in the book.
What is not known: How the attacker first obtained the static VPN accounts used at the larger heat plant is not stated. Nobody has published what recovery cost, how long the farms ran without communication to their distribution operators, or how many field devices had to be replaced rather than restored. The UK and EU attribution to FSB Centre 16 was published without its evidence, and CERT Polska cannot conclusively determine whether Sandworm took part. The 1.2 GW and 5% of capacity figures in circulation trace to no document.
Recommendation
Take the path away between sites No remote login answering on the internet at a generation site, and no shared network, private APN included, on which one site’s devices can reach another’s.
Remove credential-based device access No shipped default accounts on RTUs, relays or PLCs, no account reused across sites, and identity verified at a gateway before any session reaches a controller.
Make monitoring read one way Dashboards, historians and vendor monitoring read through a one-way path, so the systems able to send a stop command stay equal to those that must.
Sources: CERT Polska incident report, 30 Jan 2026, and follow-up, 8 Aug 2026; UK Government and Council of the EU sanctions releases, 13 Jul 2026; Poland MFA statement, 13 Jul 2026; CISA Alert, 10 Feb 2026. Full list with links.
Soft Spots: The UK and EU attribution is unevidenced in public; CERT Polska’s cluster overlap is the only technical link. Nearly half a million is a heat customer base, not people harmed. The fallback reading is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
More than thirty wind and solar farms lost their link to the grid operator and two heat and power plants were reached, yet generation continued and heat never stopped. What is verified, what is only reported, and what is still unknown.
Summary
On 29 December 2025, according to CERT Polska, an attacker disabled field devices at more than thirty wind and solar farms in Poland and struck a manufacturer and two combined heat and power plants. Generation continued and heat was never interrupted. In July 2026 the UK, with EU member states, attributed it to Russia's FSB Centre 16, without published evidence.1,2,4
Timeline of the December 2025 attack on Poland's distributed energy
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Suspicious activity at the larger combined heat and power plant dates from this period. At some point the attacker also dumps the plant's Active Directory database; the date of the dump is not stated.1
Destructive actions run, morning and afternoon, at more than thirty wind and solar farms, the larger heat plant and a manufacturer. The farms lose communication with their distribution operators but keep generating. Canary files stop a wiper on more than a hundred machines at the heat plant; heat is never interrupted.1
A second, smaller heat and power plant is reached through a wind farm and the distribution operator's private mobile network. A steam turbine and the water treatment system are shut down briefly; heat to consumers is not disrupted. CERT Polska describes this plant only in August 2026.2
Asked by an RMF radio interviewer whether Poland came close to a blackout, digital affairs minister Krzysztof Gawkowski answers "very close."7,8
Euronews reports Prime Minister Donald Tusk's remarks, which refer to two combined heat and power plants.9
ESET attributes the wiper to Sandworm with medium confidence.6
Dragos assesses with moderate confidence that a group it calls ELECTRUM is responsible.5
CERT Polska publishes its incident report: a high degree of infrastructure overlap with the Static Tundra, Berserk Bear, Ghost Blizzard and Dragonfly cluster, and no conclusive determination on Sandworm.1
CISA publishes an Alert, not an advisory, naming no actor and no country.10
The UK, together with EU member states, attributes the attack to Russia's FSB Centre 16. The UK designates 24 individuals and entities; the Council of the EU lists nine individuals and four entities. Poland's foreign ministry issues a statement on the FSB's 16th Centre.4,11,12,13
CERT Polska publishes its follow-up report on the second plant.2
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
When did the destructive actions run?
29 December 2025, morning and afternoon, at every affected facility1
Verified
What was hit?
More than thirty wind and solar farms, two combined heat and power plants and one manufacturer1,2
Verified
Did electricity generation stop?
No. The farms lost communication with their distribution operators; generation continued1
The transmission operator told CERT Polska that losing all the farms together would not have affected system stability1
Verified
How did the attacker get into the farms?
Internet-facing FortiGate VPN logins with no second factor, then default accounts on field devices1
Verified (national CERT finding)
Who was responsible?
The UK, together with EU member states, attributed it to Russia's FSB Centre 16 on 13 July 2026; the evidence is not published4,12
Verified (state attribution, evidence not public)
Did Sandworm take part?
ESET said Sandworm with medium confidence; CERT Polska cannot conclusively determine whether Sandworm participated1,6
Contested
Device models and timing at the second plant
WAGO controller, Siemens PLCs switched to stop, recovery begun with the attacker still inside, per Help Net Security's account of the follow-up3
Reported only
How were the first plant's VPN accounts obtained?
Not stated
Undisclosed
Were any devices unrecoverable?
Not disclosed
Undisclosed
Recovery cost
Not published
Undisclosed
What happened at the Polish wind and solar farms?
The attacker logged in, then used the devices' own functions against them. CERT Polska, Poland's national response team, reported on 30 January 2026 that destructive actions ran on 29 December 2025 against more than thirty wind and solar farms, a large combined heat and power plant and a manufacturing company.1 Every affected farm had a FortiGate device doubling as a VPN concentrator. The VPN login answered on the internet and did not ask for a second factor. After that, the attacker used default accounts, device class by device class:1
Hitachi RTU560 remote terminal units: firmware corrupted so that the devices fell into a reboot loop.1
Relion 650 protection relays: essential files deleted; the relays would not restart.1
Moxa NPort serial servers: reset to factory settings and given the address 127.0.0.1, which tells a device to talk to itself.1
Mikronika controllers and HMIs were also reached.1
The farms lost communication with their distribution system operators. Generation carried on. The transmission operator told CERT Polska that losing all of the farms together would not have affected the stability of the Polish power system.1 Whether any field device was left unrecoverable has not been disclosed.
At the large heat plant, suspicious activity dates from March to July 2025, and the attacker dumped the Active Directory database. On 29 December a wiper was launched. Canary files in the plant's endpoint protection product stopped it on more than a hundred machines, and heat was never interrupted. CERT Polska describes the plant as supplying heat to nearly half a million customers.1 At the manufacturer, the way in was a Fortinet device whose configuration had been stolen and published.1
CERT Polska named the Windows wiper DynoWiper and a PowerShell wiper LazyWiper, and found the similarity too low to tie DynoWiper to earlier wiper families.1 Most of the damage to field devices used no malware at all.
How did the attacker reach the second heat plant?
Through a wind farm, over the distribution operator's private mobile network. CERT Polska's follow-up report of 8 August 2026 describes a second, smaller combined heat and power plant, serving about 50,000 residents.2,3 The attacker went in through a wind farm and into the distribution operator's private APN, a network misconfigured so that any device on it could reach any other. A steam turbine and the process water treatment system at the plant were shut down.2
"Thanks to the prompt response of the CHP plant's operators, the incident resulted only in a short-term outage and did not disrupt heat supplies to consumers."
The device detail comes from Help Net Security's account of the full follow-up report, not from CERT Polska's own summary: a cellular router at the wind farm, a WAGO controller at the plant still on default web credentials, and the plant's Siemens PLCs switched to stop. The outlet reports that plant staff began recovery while the attacker was still active in the network, that CERT Polska called this the first observed instance of the private APN vector in a real-world attack, and that it judged the device reconfigurations automated with a high degree of confidence.3
When did the second plant become public? Prime Minister Donald Tusk's remarks, as Euronews reported on 15 January 2026, referred to two combined heat and power plants.9 CERT Polska's January report described one; its first technical account of the second is the August follow-up.1,2
Did Poland come close to a blackout?
No technical document says so, and the transmission operator's assessment is that the power system was not at risk. In mid January 2026, digital affairs minister Krzysztof Gawkowski was asked by an RMF radio interviewer whether Poland had come close to a blackout, and answered "very close," as Notes from Poland and The Record reported.7,8 That is a quote, not a finding. The transmission operator told CERT Polska that losing all the affected farms together would not have affected the stability of the Polish power system, and CERT Polska documents no electricity supply interruption.1
Half a million is a heat customer base, not a count of people harmed. CERT Polska describes the larger plant as supplying heat to nearly half a million customers. Heat was never interrupted there or at the second plant.1,2 The UK Government's 13 July 2026 release, the document that carries the formal attribution, says the attack "could have caused 500,000 citizens to lose electricity."4 That sentence does not match the Polish technical record. We quote it as what the release says, not as a finding.
The figures of 1.2 GW and 5% of national capacity that circulate with this incident trace to no document we could find as of late September 2026, and are not used here.
Who was behind the attack on Poland's energy sector?
The UK, together with EU member states, attributed the attack to Russia's FSB Centre 16 on 13 July 2026, without publishing the evidence. The UK designated 24 individuals and entities that day.4 The Council of the EU listed nine individuals and four entities and called it "the first time that the EU and the UK have adopted sanctions simultaneously under their respective cyber sanctions' regimes."11 A statement by the High Representative on behalf of the EU says the FSB's 16th Centre "has carried out disruptive sabotage operations against critical infrastructure, including combined heating and power plants" in Poland.12 Poland's Ministry of Foreign Affairs issued a statement the same day on the 16th Centre's activity against the defense and energy sectors; in the copy we read, it does not name the December attack.13
Attribution moved in public over seven months:
23 January 2026: ESET attributes the wiper to Sandworm with "medium confidence" and says it is "not aware of any successful disruption."6
28 January 2026: Dragos assesses with "moderate confidence" that a group it calls ELECTRUM is responsible.5
30 January 2026: CERT Polska finds that the attack infrastructure "shows a high degree of overlap" with the activity cluster publicly known as Static Tundra (Cisco), Berserk Bear (CrowdStrike), Ghost Blizzard (Microsoft) and Dragonfly (Symantec), and calls this the first publicly described destructive activity attributed to that cluster.1
10 February 2026: CISA publishes an Alert, not an advisory, that names no actor and no country.10
13 July 2026: the UK, together with EU member states, names Russia's FSB Centre 16.4,12
"However, given the very general nature of the detected similarities and the lack of strong links to known tools, CERT Polska cannot conclusively determine whether the actor behind the 'Sandworm' activity cluster participated in the attack to any extent."
The FSB and the GRU are different services. Sandworm is the name US and UK government documents tie to the GRU, Russia's military intelligence, so the two early vendor assessments point toward a different service from the one the formal attribution names. They came first, led the coverage, and are now the minority view. CERT Polska itself names clusters, not a service. Its link runs through the Dragonfly cluster, which a US indictment, returned in 2021 and unsealed in 2022, placed in FSB Center 16 (Centre 16 in UK and EU usage).1,14 An indictment is an allegation, not a conviction, and no indictment or court has addressed the Polish attack itself.
Is this the same as the Tczew hydropower incident?
No: same country and same year, four months apart, with no actor in common on the record and a different mechanism. The Tczew reports concern an August 2025 claim video of a small hydropower plant's control screen being operated, reported as Tczew and disputed at source. This entry covers the coordinated destructive attack of 29 December 2025 on distributed energy: more than thirty wind and solar farms, two combined heat and power plants and a manufacturer.1,2 The August 2025 incident has its own entry, Polish Hydropower Plant.
What is still not known about Poland Distributed Energy
How the attacker first obtained the static VPN accounts used at the larger heat plant.1
What recovery cost. No operator or authority has published a figure.
How long the farms ran without communication to their distribution operators.
How many field devices had to be replaced rather than restored, and whether any were unrecoverable.
The evidence behind the UK and EU attribution to FSB Centre 16, which has not been published.4,12
Whether Sandworm took part. CERT Polska cannot conclusively determine it.1
The source of the 1.2 GW and 5% of national capacity figures in circulation, which trace to no document we could find as of late September 2026.
Claims about Poland Distributed Energy the record does not support
Widely repeated claim
What the record says
"State military intelligence deployed a wiper against heat and power plants in December."
The formal attribution, by the UK together with EU member states, names Russia's FSB Centre 16, a different service from military intelligence. ESET's Sandworm link was a medium-confidence vendor assessment, and CERT Polska cannot conclusively determine whether Sandworm took part.1,4,6,15
"ELECTRUM attacked Poland's distributed energy."
Dragos's assessment, at moderate confidence, on 28 January 2026. It is now the minority view: the state attribution of July 2026 names the FSB.4,5
"The attack could have caused 500,000 citizens to lose electricity."
That is the UK Government release's wording. Nearly half a million is the larger plant's heat customer base, heat was never interrupted at either plant, and the transmission operator found no effect on system stability.1,2,4
"Poland came very close to a blackout."
A minister's answer to a radio interviewer in mid January 2026. No technical document supports it; the transmission operator told CERT Polska the system's stability was not affected.1,7,8
"CERT Polska tied the second plant to Sandworm."
Reported by one trade outlet. Help Net Security and The Record report that the follow-up report attributes no actor.3,16
Including our own. Our Tczew anniversary blog, published on blastwave.com on 10 August 2026, describes this attack in two paragraphs. It states as fact that "State military intelligence deployed a wiper against heat and power plants in December" and that "Sandworm needed to find the heat and power plants in December," and it relays Polish reporting that the attempt "could have cut heat and power to at least half a million homes."15 The formal attribution names the FSB, a different service; Sandworm's part is undetermined; and half a million is one plant's heat customer base, with heat never interrupted. All three are corrected on this page. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: what held was not the architecture
Analysis, not a disclosed fact
Distributed energy moves the perimeter. A coal plant has one fence. Thirty wind and solar farms have thirty firewalls, thirty cabinets of field devices, and a telemetry network, run by someone else, that ties every one of them to the grid operator. On 29 December 2025 an attacker used that shape against itself. The remote login that lets a technician in from home let the attacker in, the passwords the devices shipped with still worked, and a private mobile network built so that sites could report to their distribution operator let one wind farm reach a heat plant it had no reason to know existed.1,2
None of that is exotic, and none of it is a detection failure. It is reachability and identity, at more than thirty sites at once. What held was not the architecture. At the farms, generation simply carried on without its supervisory link, which is the fallback nobody gets credit for. At the large heat plant, canary files in an endpoint product stopped a wiper on more than a hundred machines. At the smaller one, operators restored a stopped steam turbine and water treatment system while the attacker was still inside.1,2,3 Nothing here is a competence story. That the same intrusion against sites without those fallbacks would have ended differently is BlastWave's analysis, not a disclosed fact.
Podcast: “The Party Line” (9:16). Joe Baxter and Cam Cullen on how a network built so small sites could report to their operator let one site reach another.
Video: Poland Distributed Energy Short (60 to 90 seconds).
Frequently asked questions
What happened in the December 2025 cyberattack on Poland's energy sector?
On 29 December 2025, according to CERT Polska, Poland's national response team, an attacker ran destructive actions against more than thirty wind and solar farms, a large combined heat and power plant and a manufacturing company. A second, smaller heat plant was also reached, as CERT Polska described in August 2026. The farms lost communication with their grid operators but kept generating, and heat was never interrupted at either plant.
Who was behind the attack on Poland's wind farms and heat plants?
On 13 July 2026 the UK, together with EU member states, attributed the attack to Russia's FSB Centre 16, alongside the first cyber sanctions the UK and EU adopted simultaneously. The evidence behind that attribution has not been published. CERT Polska had earlier found, in January 2026, a high degree of infrastructure overlap with the cluster known as Static Tundra, Berserk Bear and Dragonfly. No indictment or court has addressed the attack.
Was Sandworm or the GRU responsible for the Poland energy attack?
That was the early vendor view, not the formal attribution. ESET attributed the wiper to Sandworm with medium confidence on 23 January 2026, and Dragos assessed with moderate confidence on 28 January that a group it calls ELECTRUM was responsible. CERT Polska said it cannot conclusively determine whether Sandworm took part. The UK and EU later named the FSB, a different Russian service from the GRU.
Did Poland come close to a blackout in December 2025?
No technical document says so. Digital affairs minister Krzysztof Gawkowski answered "very close" when an RMF radio interviewer asked him in mid January 2026, as Notes from Poland and The Record reported. CERT Polska's report records the transmission operator's assessment that losing all the affected farms together would not have affected the stability of the Polish power system. Heat was never interrupted at either plant.
Did half a million people lose heat or power?
No. Nearly half a million is the heat customer base of the larger combined heat and power plant, as CERT Polska described it in January 2026, not a count of people affected. Heat was never interrupted there or at the second plant. The UK Government's 13 July 2026 release says the attack "could have caused 500,000 citizens to lose electricity," which does not match the Polish technical record.
How did the attackers get into the Polish wind and solar farms?
According to CERT Polska's January 2026 report, every affected farm had a FortiGate device acting as a VPN concentrator whose login answered on the internet without a second factor. Once inside, the attacker used default accounts on field devices: remote terminal units got corrupted firmware and fell into reboot loops, protection relays had essential files deleted, and serial servers were reset to factory settings.
What did CISA say about the Poland energy sector incident?
CISA published an Alert, not an advisory, on 10 February 2026, titled "Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps." It names no actor and no country. Its recommendations lead with changing default passwords, the same weakness CERT Polska found on field devices across the affected wind and solar farms.
Is the December 2025 Poland energy attack the same as the Tczew hydropower incident?
No. Tczew refers to an August 2025 claim video showing a small hydropower plant's control screen being operated, reported as Tczew and disputed at source. The December 2025 attack on distributed energy is a separate incident four months later, with a different mechanism and no actor in common on the record. Both happened in Poland in 2025, which is why they are sometimes confused.
Primary sources are CERT Polska's two reports, the UK, EU and Polish government statements of July 2026, the CISA Alert, the US indictment, and the named researchers' own dated publications. Press is cited only as evidence of what was said or reported.
GovernmentCERT Polska, "Energy Sector Incident Report: 29 December 2025," full report and English summary post, 30 January 2026. cert.pl · Report (PDF)
GovernmentCERT Polska, "Follow-Up Report of the December 2025 Energy Sector Incident," 8 August 2026. cert.pl
PressHelp Net Security, account of the CERT Polska follow-up report, 11 August 2026 (device models and timing at the second plant). Cited as evidence of what was reported.
GovernmentUK Government, "UK and EU strike Russian cyber networks with new sanctions," 13 July 2026. gov.uk
ResearcherDragos, "Poland Power Grid Attack: ELECTRUM Targets Distributed Energy," 28 January 2026. dragos.com
ResearcherESET Research, WeLiveSecurity, research post attributing the wiper to Sandworm, 23 January 2026. welivesecurity.com
PressNotes from Poland, report on Digital Affairs Minister Krzysztof Gawkowski's RMF radio interview, 14 January 2026. Cited as evidence of what was said.
PressThe Record, report on the minister's RMF interview, January 2026. Cited as evidence of what was said.
PressEuronews, report on Prime Minister Donald Tusk's remarks, 15 January 2026. Cited as evidence of what was said.
FederalCISA, Alert, "Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps," 10 February 2026.
GovernmentCouncil of the EU, "Russian cyber-attacks and destabilising activities: Council sanctions nine individuals and four entities," press release, 13 July 2026.
GovernmentHigh Representative, on behalf of the EU, statement denouncing Russia's malicious cyber ecosystem, 13 July 2026.
GovernmentMinistry of Foreign Affairs of the Republic of Poland, "Statement on Russian malicious activities in cyberspace," 13 July 2026. gov.pl
FederalUS Department of Justice, press release on the unsealing of an indictment of four Russian government employees for historical hacking campaigns against critical infrastructure, including the Dragonfly (Havex) campaign attributed to Center 16 of the FSB, 24 March 2022. Indictment returned 26 August 2021. justice.gov
CompanyBlastWave, "One Year After Tczew," blastwave.com blog, 10 August 2026. blastwave.com
PressThe Record, report on CERT Polska's follow-up report, August 2026. Cited as evidence of what was reported. therecord.media
Cite this page
BlastWave. “Poland Distributed Energy Cyberattack (2025): What Is Verified.” Hackopedia, Volume 2, FILE 028. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/poland-distributed-energy-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 028 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Hand-check at source: CERT Polska's January report and English summary re-read for the infrastructure overlap wording, the "first publicly described destructive activity" sentence and the heat customer figure, and the August follow-up re-read for the operators' "prompt response." Restored CERT Polska's own wording that it cannot conclusively determine whether Sandworm took part. The FSB unit is now spelled as each source spells it: Center 16 in the US indictment, Centre 16 in UK, EU and CERT Polska documents. Checked every other Hackopedia entry that mentions Poland for the same attribution and scale wording.
26 Sep 2026
Full validation against CERT Polska, the UK and EU releases, ESET, Dragos and the US indictment. Corrected the indictment's date to returned in 2021 and unsealed in 2022. Confirmed that our Tczew anniversary blog of 10 August 2026 misdescribes this attack and listed it for correction. Two CERT Polska quotations were softened until they could be checked by hand.
24 Sep 2026
Volume 2 entry built from primary sources. The state attribution leads; the earlier vendor attributions are shown with their confidence levels; half a million is stated as a heat customer base, not a count of people affected.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
