In August 2025 a pro-Russian channel posted video of someone stopping a small Polish hydro plant's generator from its control screen. A separate event from December's energy attack. No one has confirmed which plant.
This is among the cheapest attacks in the book and has one of its thinnest records. No malware has been reported, and none would have been needed: the video shows a person pressing buttons on an operator screen, and the screen doing what screens do. The only question it raises is how a stranger reached that screen. That it answered the internet with a password or less is BlastWave's analysis, consistent with a December 2025 joint advisory, not a disclosed fact about this plant.
The rest is silence, and it is the story. One Polish outlet offered Tczew as a possibility, then printed a supplier's objection twice in two days. The objection never travelled; the name did, into English coverage, an incident database and our own blog, which stated it as fact and misdescribed the separate December attack. Corroborated, the claim would sit on the ladder's top rung; the record, on none.
What is not known: No operator, regulator, CERT Polska or ministry statement has confirmed that the plant in the video exists as shown, where it is, or that its generator stopped. Tczew was offered by one Polish outlet as a possibility and disputed in its own updates within two days. The date, 10 August 2025, is that outlet's reading of graphs inside the video. How the screen was reached, whether a password was used and what output or repair it cost are undisclosed; that a June video shows the same plant is the outlet's view. No government or vendor has attributed the video.
Recommendation
Take the path away No operator screen, remote desktop or remote login at a generating site answers from the internet. A stranger who cannot reach the screen cannot press its buttons.
Remove credential-based access A password, shared or vendor-issued, never opens a session to a plant on its own. Identity is checked at a gateway in front of the site, per person and per device.
Make watchers watch one way Anyone who only needs the numbers reads them one way. A one-way record the owner keeps is also how an owner proves, quickly, whether a video is theirs.
Sources: CyberDefence24, 18 Aug 2025, updates 18 and 20 Aug; CyberDefence24, 1 Jul 2025; Forsal, 2 Jul 2025; Onet Rano via Polsat News, 14 Aug 2025 (Gawkowski, water supply); AA25-343A, 9 Dec 2025. Full list with links.
Soft Spots: Tczew is one outlet's “could have been,” disputed by a supplier; every screen value is that outlet's reading of a video we did not view. That the screen answered the internet is BlastWave's inference. Gawkowski's own posts were not checked.
The full record
Every claim numbered to its source. Last updated .
A pro-Russian channel's video of a small hydro plant's control screen being driven until its generator stopped, and a town's name that its own source questioned within two days. What is verified, what is only claimed or reported, and what is still unknown.
Summary
In August 2025, a pro-Russian hacktivist channel posted a video of someone operating a small hydropower plant's control screen in northern Poland until its generator stopped. No operator, authority or court has confirmed which plant it was or that anything physical happened. One Polish outlet suggested Tczew, then printed an objection within two days.1
Timeline of the Polish hydropower plant video
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Forsal later dates a claim naming a hydro plant in Gdańsk, made alongside a claim about a bioreactor, to this day. CyberDefence24 attaches 9 May only to the separate bioreactor video.2,7
Pro-Russian hacktivists publish an earlier video. CyberDefence24 later says it came from the same plant, and that the plant in it looked switched off ("wyglądała na wyłączoną").1
CyberDefence24 reports the earlier video: the claimants name "hydroelektrownię w Gdańsku" (a hydroelectric plant in Gdańsk), a location the outlet calls unverified. Forsal reports the same videos on 2 July and also names Gdańsk, not Tczew.2,7
CyberDefence24's reading of the graphs inside the video places the event here, "najprawdopodobniej" (most likely). No operator record confirms it.1
A pro-Russian hacktivist channel publishes the video of the control screen being operated.1
On Onet Rano, Deputy Prime Minister Krzysztof Gawkowski says an attack on Wednesday 13 August on a large city's water and sewage infrastructure was caught "w ostatniej chwili" (at the last moment). He is not speaking about a hydro plant.8
CyberDefence24 analyzes the video. Matching the plant's output, head and turbine type, it writes that the target "mogła być" (could have been) the small hydro plant in Tczew, and says it is awaiting the infrastructure manager's position.1
First update: a representative of Małe Elektrownie Wodne S.C., a company that had sold equipment to MEW Tczew, says the equipment in the video was not supplied by the company, that none of the equipment it supplied was attacked, and that its equipment is not visible from the network.1
English coverage in Dark Reading, Cybernews and SC Media states Tczew as the site, with an earlier May breach while the plant was offline. UNITED24 Media, as now published, says "near Gdańsk."9,10,11,12
Second update: the same representative says that in his view it is not the Tczew plant, because the plant in the video had no gearbox.1
The FBI, CISA, NSA and partners publish joint advisory AA25-343A on pro-Russia hacktivists operating internet-reachable operator screens and posting recordings. It does not mention Poland or any hydro plant.6
The ICSSTRIVE incident database publishes "ICS/OT Cyberattack Disrupts Operations at Tczew Hydropower Plant, Poland," citing three news articles.5
BlastWave publishes a blog that states Tczew as fact; this entry corrects it. The same day, CyberDefence24 reports charges by prosecutors in Białystok against two Russian citizens over seventeen cyberattacks; the published list names no hydro plant.3,4
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Does a video of the control screen exist?
Yes. Published 12 August 2025 by a pro-Russian hacktivist channel, as reported and described by CyberDefence241
Reported (BlastWave has not viewed it)
Which plant is it?
Not established. Tczew was offered as "could have been" and disputed in the same outlet's updates within two days; the claimants' earlier video named Gdańsk1,2
Contested
Did the generator stop?
The claimants' video shows it, per CyberDefence24's reading. No operator or authority has corroborated it1
Claimed only
When did it happen?
Most likely 10 August 2025, 21:00 to 22:00, read from graphs inside the video1
Reported only
Who did it?
Claimed by an unnamed pro-Russian hacktivist channel. No government, CERT or vendor attribution1
Claimed, not attributed
How was the screen reached?
No account exists in any source read as of late September 2026
None reported by anyone. The 99.9 m water level is a display value, not a river1
None reported
Has the operator made a statement?
None found. CyberDefence24 was awaiting one on 18 August 20251
Undisclosed
Does advisory AA25-343A mention this plant?
No. It describes the technique in general and does not mention Poland6
Verified
Is it part of the December 2025 attack on Polish energy?
No. The December attack was a separate incident four months later, with no actor in common on the record; the UK attribution of that attack does not mention this plant13
Verified (separate incident)
Was it in the Białystok charges of August 2026?
No hydro plant in the published list of seventeen attacks, as reported4
Reported only
Which hydropower plant was it? Was it Tczew?
No operator, authority or court has named the plant; Tczew was one outlet's "could have been," disputed in that outlet's own updates within two days. The name's path can be walked date by date in the Polish record:
1 July 2025: CyberDefence24 reports an earlier video in which the claimants named a "hydroelektrownię w Gdańsku" (a hydroelectric plant in Gdańsk), and calls the location unverified.2
18 August 2025, 13:31: matching the output, head and turbine type, CyberDefence24 writes that the target "mogła być" (could have been) the small hydro plant in Tczew.1
18 August 2025, 15:00: a representative of Małe Elektrownie Wodne S.C., which had sold equipment to MEW Tczew, says the equipment in the video was not supplied by the company and that its equipment is not visible from the network.1
19 and 20 August 2025: English coverage states Tczew flat.9,10,11
20 August 2025, 11:15: the same representative says that in his view it is not the Tczew plant, because the plant in the video had no gearbox.1
The objection is a supplier's statement, not the operator's, and it does not settle the question either way. What it does show is that the identification was questioned at source before most of the copies were written. An incident database later listed the event under Tczew, citing three of those news articles; none of them is the plant.5 The correction was published. It did not travel.
What does the video show, and did the generator really stop?
The video shows someone changing parameters on an operator screen until turbine and generator speed swing to extremes and power output falls to zero; the only witness to any physical effect is the claimants' own footage. BlastWave has not viewed it. Every value below is CyberDefence24's reading of its screens.1
Turbine and generator speed driven to extremes and to a stop.
Power output to zero and briefly negative, on a unit the screens read at about 75 kW, with a Kaplan-type turbine.
A water level reading changed to 99.9 m, which the outlet notes cannot be physically true. That is a person typing into a field, not a river doing anything.
Most likely 10 August 2025, 21:00 to 22:00, read from graphs inside the video.
CyberDefence24 read the graphs as a real, running plant. That is a journalist's careful reading, not an operator's record. The outlet said on 18 August 2025 that it was awaiting the infrastructure manager's position; no operator statement has been found, and nobody has reported an outage, damage or injury.1 Compare Bremanger Dam in Norway, where a similar hacktivist video of a control panel met the owner's own account and a security service's statement.14 Here there is no second witness.
How did someone reach the plant's control screen?
Nobody has said. No operator, authority or researcher has published an account of how the screen was reached or whether a password was used. No malware has been reported, and none would have been needed to press buttons on a screen.1
Joint advisory AA25-343A, published on 9 December 2025 by the FBI, CISA, NSA and partners, describes the pattern for these groups in general: operator screens reachable from the internet, default, weak or no passwords, and screen recordings posted to boast. It does not mention Poland or any hydro plant.6 That this screen was reachable that way is BlastWave's analysis, not a disclosed fact about this plant.
Who was behind the Polish hydropower plant video?
A channel the Polish press describes as pro-Russian hacktivists claimed it by video; no government, CERT or vendor has attributed it. CyberDefence24 does not name the channel, and in August 2026 said it withholds such names deliberately.1,4 A claim is evidence of a claim.
Advisory AA25-343A names Z-Pentest, Sector16, CARR and NoName057(16) as groups using this technique in general; it does not mention Poland or any hydro plant.6 Adjacency is not attribution.
In August 2026 the regional prosecutor's office in Białystok charged two Russian citizens over seventeen cyberattacks, seven of them on water and wastewater facilities. As reported by CyberDefence24, the published list includes hotels, companies and a hospital, names no hydro plant, and states "W wyniku ataków nie powstały szkody materialne" (the attacks caused no material damage).4 The prosecutor's own release was not read for this entry.
Did Poland's minister say this attack was stopped at the last moment?
No. The "last moment" remark was about a large city's water supply, not a hydro plant. On 14 August 2025, on Onet Rano, Deputy Prime Minister and digital affairs minister Krzysztof Gawkowski spoke about an attack on Wednesday 13 August on the water and sewage infrastructure of a large city:8
"Udało się w ostatniej chwili doprowadzić do tego, że kiedy rozpoczynał się atak, nasze służby się o tym dowiedziały"
In English, roughly: at the last moment, our services learned of the attack as it was beginning (BlastWave's translation). Reuters reported the remark the same day as an attack on a large city's water supply stopped "at the last moment."8 No statement by him naming a hydro plant or Tczew was found in Polish press or ministry releases checked in September 2026.
Is this the same as the December 2025 attack on Polish energy?
No. It is a separate incident, four months earlier, with a different mechanism, different evidence and no actor in common on the record. On 29 December 2025 a coordinated destructive attack hit more than thirty wind and solar farms and two combined heat and power plants in Poland. On 13 July 2026 the UK, together with EU member states, attributed that attack to Russia's FSB Centre 16. The UK release does not mention this plant.13,15
The "half a million homes" that our August 2026 blog said the attack could have cut off is a misreading: nearly half a million is the larger heat plant's heat customer base, per CERT Polska, and heat supply to consumers was not interrupted.15 The December attack has its own entry, Poland Distributed Energy.
What is still not known about Polish Hydropower Plant
Whether the plant in the video exists as shown, and where it is. No operator, regulator, CERT Polska or ministry statement has confirmed it, as of late September 2026.1
Whether its generator actually stopped, or anything physical happened at all.
When the event happened. 10 August 2025 is CyberDefence24's "most likely" reading of graphs inside the video.1
How the screen was reached, and whether a password was used.
What output, repair or money it cost.
Whether the June and August videos show the same plant. That is the outlet's view.1
When the earlier footage was recorded: CyberDefence24 says it was published in June; Forsal dates the Gdańsk claim to 9 May 2025.1,7
Who posted it. No government or vendor has attributed the video.
Whether the operator ever gave CyberDefence24 the position it was awaiting. None has been found.1
Claims about Polish Hydropower Plant the record does not support
Widely repeated claim
What the record says
"Russian hackers attacked the hydropower plant in Tczew."
Tczew was CyberDefence24's "could have been," disputed in its own updates on 18 and 20 August 2025. No operator, authority or court has named a site.1,11
"Russia attacked a Polish power plant."
A pro-Russian hacktivist channel claimed it by video. No government, CERT or vendor has attributed it, and pro-Russian hacktivists are not the Russian state.1
"The attack disrupted operations at the plant."
The only witness to any effect is the claimants' own video. No outage, damage or injury has been reported by anyone.1,5
"The same plant was breached in May 2025 while offline for maintenance."
CyberDefence24 says the earlier video was published in June and the plant in it looked switched off. Forsal dates the Gdańsk claim to 9 May. No source says maintenance.1,3,7
"Analysts confirmed the video against the plant's own monitoring data."
The outlet read graphs inside the video, wrote "could have been," and was still awaiting the operator. No operator data has been published.1,3
"The attackers got in through a VPN with harvested credentials."
No source describes how the screen was reached. There is no "working assessment across public reporting."3
"Investigators found no malware."
None has been reported, but no forensic account exists. An incident database's "no malware identified" rests on three news articles.5
Including our own. Our own blog, "One Year After Tczew: The OT Attack That Didn't Need Malware," published on blastwave.com on 10 August 2026, stated Tczew as the site; said analysts had confirmed the video against the plant's own monitoring data; said the facility "had been breached in May 2025" "while the plant was offline for maintenance"; asserted a "working assessment across public reporting" of a VPN and harvested credentials; presented an incident database's "no malware identified" as an investigative finding; and described a 5 MW plant when the screens read about 75 kW. On the separate December 2025 attack it carried one vendor's medium-confidence Sandworm view, then wrote "State military intelligence deployed a wiper" and "Sandworm needed to find the heat and power plants" as fact, four weeks after the UK and EU attribution to FSB Centre 16, and repeated that the attack could have cut "heat and power to at least half a million homes," a heat customer base where the heat never stopped. It also misstated facts about the NotPetya / Maersk, Norsk Hydro and Bremanger Dam incidents; see those entries.3,13,15 We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: a screen a stranger could reach, and a name nobody could check
Analysis, not a disclosed fact
This is among the cheapest attacks in the book and has one of its thinnest records, and those are the same fact seen twice. No malware has been reported, and none would have been needed: the video shows a person pressing buttons on an operator screen, and the screen doing what operator screens do. The only technical question the footage can answer is how that screen came to be reachable by a stranger, and nobody has answered it. That it was reachable from the internet with a password or less is BlastWave's analysis, consistent with the pattern a December 2025 joint advisory describes for these groups, not a disclosed fact about this plant.6
Nothing here is about the operator, who has never been identified and owes nobody a statement. On this volume's consequence ladder the claim, if it were corroborated, would sit on the top rung, OT command execution with corroborated physical effect; the corroborated record sits on none of them. A plant that can be driven from a screen anyone can reach, and whose owner cannot quickly prove whether a video is theirs, has two gaps rather than one.
Podcast: “A Name on a Picture” (9:32). Joe Baxter and Cam Cullen on how a town's name travelled further than the correction printed beneath it.
Video: Polish Hydropower Plant Short (60 to 90 seconds).
Frequently asked questions
What happened at the Polish hydropower plant in August 2025?
On 12 August 2025 a pro-Russian hacktivist channel posted a video of someone operating a small hydro plant's control screen in northern Poland, driving turbine and generator speed to extremes until power output fell to zero. The Polish outlet CyberDefence24 dated the event, most likely, to the night of 10 August. No operator, authority or court has confirmed which plant it was or that anything physical happened.
Was the Polish hydropower plant in the video in Tczew?
That has never been confirmed. On 18 August 2025 CyberDefence24 wrote that the target could have been the small hydro plant in Tczew. The same afternoon it printed an objection from Małe Elektrownie Wodne S.C., a company that had sold equipment to that plant, and on 20 August the company's representative said that in his view it was not Tczew, because the plant in the video had no gearbox. The claimants' earlier video named Gdańsk.
Did the hydro plant's generator really stop?
Only the claimants' own video shows it. CyberDefence24, which analyzed the footage on 18 August 2025, read the screens as a real running plant, with power output falling to zero and briefly below it, and a water level reading changed to 99.9 meters, which it noted cannot be physically true. No operator, regulator or ministry has corroborated any physical effect, and nobody has reported an outage, damage or injury.
Who was behind the Polish hydropower plant video?
The video was posted by a channel the Polish press describes as pro-Russian hacktivists, and CyberDefence24 does not name it. As of late September 2026, no government, CERT or vendor had attributed the video. Joint advisory AA25-343A of 9 December 2025 names groups using this technique in general but does not mention Poland. Charges brought in Białystok in August 2026, as reported, list no hydro plant.
How did the attackers reach the plant's control screen?
Nobody has said. No operator, authority or researcher has published an account of access, and no malware has been reported. Joint advisory AA25-343A, published by the FBI, CISA, NSA and partners in December 2025, describes operator screens reachable from the internet with default, weak or no passwords, but it does not mention this plant. That this screen was reachable that way is BlastWave's analysis, not a disclosed fact.
Is the hydropower plant video part of the December 2025 cyberattack on Polish energy?
No. The hydro video was posted in August 2025. The separate attack of 29 December 2025 hit more than thirty wind and solar farms and two combined heat and power plants, and the UK, together with EU member states, attributed it to Russia's FSB Centre 16 on 13 July 2026. The two share a country and a year but no actor in common on the record, and the mechanism differs.
Did Poland's minister say the hydro plant attack was stopped at the last moment?
No. Deputy Prime Minister and digital affairs minister Krzysztof Gawkowski said on Onet Rano on 14 August 2025 that an attack on 13 August on a large city's water and sewage infrastructure had been caught at the last moment, as reported by Polsat News, Wirtualna Polska and Interia. He was not speaking about a hydro plant, and no statement by him naming a hydro plant or Tczew has been found.
No operator, CERT, ministry or court has published anything about this plant, so the nearest thing to a primary source is the claimants' video as read by the Polish outlet CyberDefence24; Polish and English press are cited as evidence of what was said, and government documents only for what they do and do not say.
PressCyberDefence24, Oskar Klimczuk, "Polska elektrownia ponownie zaatakowana przez Rosję" (Polish power plant attacked by Russia again), 18 August 2025, 13:31, with updates of 18 August 2025 (15:00) and 20 August 2025 (11:15). The fullest description of the claimants' video, which BlastWave has not viewed. Polish quotations are BlastWave's translations. cyberdefence24.pl
PressCyberDefence24, Oskar Klimczuk, "Rosjanie zaatakowali polską elektrownię i wodociąg" (Russians attacked a Polish power plant and a waterworks), 1 July 2025. The earlier video; the claimants' "hydroelektrownię w Gdańsku," location unverified. cyberdefence24.pl
CompanyBlastWave, "One Year After Tczew: The OT Attack That Didn't Need Malware," blastwave.com, 10 August 2026. Cited as the error being corrected. blastwave.com
PressCyberDefence24, Oskar Klimczuk, "Seria ataków na polskie wodociągi. Dwóch Rosjan z zarzutami prokuratury" (A series of attacks on Polish waterworks: two Russians charged by prosecutors), 10 August 2026, on charges by the Prokuratura Okręgowa w Białymstoku (Regional Prosecutor's Office in Białystok). The prosecutor's own release was not read. cyberdefence24.pl
ResearcherICSSTRIVE, incident record "ICS/OT Cyberattack Disrupts Operations at Tczew Hydropower Plant, Poland," published 23 January 2026, citing UNITED24, SC Media and Cybernews. An incident database, cited as evidence of what was said. icsstrive.com
FederalFBI, CISA, NSA and partners, Joint Cybersecurity Advisory AA25-343A, "Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure," 9 December 2025. Cited for the general technique and for what it does not say: it does not mention Poland or any hydro plant. PDF · IC3 copy (PDF)
PressForsal, Przemysław Paterek, report of 2 July 2025 on the same videos. Names Gdańsk, not Tczew, and dates the Gdańsk claim, with a bioreactor claim, to 9 May 2025. Cited as evidence of what was said. forsal.pl
PressPolsat News, Wirtualna Polska and Interia, reports of 14 August 2025 on Deputy Prime Minister Krzysztof Gawkowski's interview on Onet Rano that day, about an attack on 13 August on a large city's water and sewage infrastructure; Reuters reported the remark the same day. Not about a hydro plant. polsatnews.pl · wp.pl · interia.pl
PressDark Reading, report of 19 August 2025 stating Tczew as the site and an earlier May breach while the plant was offline. Cited as evidence of what was said. darkreading.com
PressCybernews, report of 19 August 2025, updated 20 August, stating Tczew as the site and an earlier May breach while the plant was offline. Cited as evidence of what was said. cybernews.com
PressSC Media, brief of 20 August 2025 stating Tczew as the site and an earlier May breach while the plant was offline. Cited as evidence of what was said. scworld.com
PressUNITED24 Media, report of 19 August 2025, updated 20 August; as now published it says "near Gdańsk" and May. Cited as evidence of what was said. united24media.com
GovernmentUK Government, "UK and EU strike Russian cyber networks with new sanctions," 13 July 2026. Attributes the December 2025 attack on Poland's energy grid to FSB Centre 16; does not mention this plant. gov.uk
PressBleepingComputer, "Pro-Russian hackers blamed for water dam sabotage in Norway," 14 August 2025. Cited for the Bremanger Dam comparison only. bleepingcomputer.com
GovernmentCERT Polska, "Energy Sector Incident Report - 29 December 2025," January 2026, and "Follow-Up Report of the December 2025 Energy Sector Incident," 8 August 2026. Cited only for the separate December attack: the heat customer base and the absence of heat disruption. cert.pl · Report (PDF) · Follow-up, 8 August 2026
Cite this page
BlastWave. “Polish Hydropower Plant Incident (2025): What Is Verified.” Hackopedia, Volume 2, FILE 017. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/polish-hydropower-plant-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 017 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Consistency re-check against the Bremanger Dam, TwoNet and Poland Distributed Energy entries. Restored a qualifier that had been dropped: the claim would rank as a corroborated physical effect only if it were corroborated.
26 Sep 2026
Full validation. Re-confirmed each error in our August 2026 blog on the live page. Softened "the cheapest attack in the book" to "among the cheapest," which the record supports. Corrected the Bremanger Dam comparison to one valve and just under four hours, by the owner's account.
25 Sep 2026
Second validation against the Polish-language originals. Corrected the date and venue of the minister's "last moment" remark (14 August 2025, on Onet Rano, about an attack on 13 August); recorded that the objecting company had sold equipment to the Tczew plant; traced the May date to Forsal; and matched the advisory's first mitigation word for word.
24 Sep 2026
Volume 2 entry built from the Polish record. Corrected our August 2026 blog, which stated Tczew as fact, invented a monitoring-data confirmation, a maintenance-window breach and an access assessment, and misdescribed the separate December 2025 attack.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
