Breaches and incidentsBriefChecked against a primary source
Poland: destructive attack on 30+ renewable sites, a CHP plant and a manufacturer
CERT Polska (30 Jan): on 29 Dec 2025 attackers damaged RTU firmware at 30+ wind and solar grid connection points (communication with the DSO lost...
- Disclosed
What happened
- CERT Polska (30 Jan): on 29 Dec 2025 attackers damaged RTU firmware at 30+ wind and solar grid connection points (communication with the DSO lost, generation unaffected) and tried to wipe a CHP plant serving almost half a million customers (EDR blocked it) and a manufacturer.
- Technique: per THN’s summary of the report, FortiGate SSL-VPN accounts without 2FA at the CHP and vulnerable Fortinet devices elsewhere; DynoWiper and the PowerShell LazyWiper (possibly LLM-assisted); data theft from the CHP since Mar 2025.
- Attribution: CERT Polska sees a “high degree of overlap” with Static Tundra / Berserk Bear (FSB Center 16, see AA26-194A); ESET and Dragos assess Sandworm / ELECTRUM with moderate confidence. Contested.
Sources
- https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/
- https://thehackernews.com/2026/01/poland-attributes-december-cyber.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.