On 8 August 2026, after a three-month investigation, CERT Polska published its account of an intrusion at a Polish combined heat and power plant — a facility supplying heat to roughly 50,000 residents. The attack itself happened in December 2025. Poland's prime minister had mentioned in January that two CHP plants were hit; this is the second of them to be described in detail.
The plant is not named. Almost everything else is.
The route
| When | What |
|---|---|
| — | FortiGate firewall at a wind farm, internet-exposed, VPN accepting accounts without MFA |
| 18–25 Dec | Attacker scans the private APN, finds a WAGO PFC200 controller with default admin credentials |
| 25 Dec | Connects to three Siemens PLCs over S7 — reconnaissance only |
| 29 Dec, 05:30–10:10 | Siemens controllers switched to STOP and password-protected; steam turbine and process-water treatment shut down |
Recovery began around 07:30, while the attackers were still active on the network. Customers lost neither heat nor electricity.
The part CERT calls a first
The pivot did not go over the internet. It went over a private APN — a dedicated cellular data network operated by the local distribution system operator, the kind of link an energy utility uses to reach remote sites without exposing them publicly.
CERT Polska describes this as the first instance of that attack vector being observed in a real-world cyberattack.
The mechanism is mundane, which is the point. Polish organisations running private APNs commonly let any device on the network reach any other. A wind farm and a heat plant have no business talking to each other. On the APN, they could.
CERT's first recommendation is correspondingly plain: audit the private APN configuration and switch on client isolation.
The equipment list
- FortiGate firewall (initial access)
- Teltonika RUTX50 cellular router
- WAGO PFC200 controller
- Siemens S7-300, S7-1200, S7-1500 PLCs
- Seven Moxa serial device servers
Read that list the way an incident responder would. There is no zero-day in it.
No CVE was established as the cause. The WAGO controller retained its default admin credentials. The private APN permitted client-to-client traffic. The Teltonika router's SSH service and the controller's web interface functioned exactly as configured.
Everything worked as designed. The design was the problem.
Eleven days of nothing, then forty minutes
The gap between the scan on 18 December and the destructive action on 29 December is the most operationally useful detail in the report.
The attacker was on the network for eleven days before touching anything. They connected to the Siemens PLCs on the 25th and did nothing. Then, on the 29th, between 05:30 and 10:10 — early morning, holiday week — they stopped the controllers and set passwords on them.
Password-protecting a PLC after switching it to STOP is not a ransomware move and it is not noise. It is an attempt to extend the outage by making recovery require the vendor.
That is the window defenders had, and it is a generous one. Eleven days of an unfamiliar device scanning an APN is detectable if anyone is looking at the APN. Nobody was, because the APN is a telecoms product and the security team does not own it.
Attribution: nobody has named anyone
The broader December campaign drew four separate assessments in January — from Poland's government, CERT Polska, ESET and Dragos. None of them addressed this specific intrusion, and no actor has been named for it.
That is worth stating plainly, because the surrounding coverage tends to fill the gap. A CHP plant in Poland in December 2025 invites an obvious assumption. The report does not make it, and neither will we.
What this changes for anyone running OT
- Your private APN is a flat network until you prove otherwise. Client isolation is a setting. Ask whether it is on. If the answer takes more than a day to obtain, that is itself the finding.
- Default credentials on a controller are not a low-severity item when the controller is reachable from a network you do not monitor. Severity is a function of reachability.
- Shared infrastructure between generation sites is a trust relationship. A wind farm and a heat plant sharing an APN means the wind farm's firewall is the heat plant's firewall.
- Watch for STOP-plus-password as a signature. It is a deliberate recovery-delay tactic and it distinguishes a destructive operator from an opportunistic one.
The recurring lesson across the OT incidents we have covered this year — the Minnesota water systems reached with no exploit at all among them — is that the attacks are not clever. They are patient, and they use the parts of the network that nobody has drawn on a diagram.
