Hackers Breach Polish Power Plant via Cellular Network in Landmark ICS Attack

A cyberattack on a Polish combined heat and power plant in December 2025 shut down a steam turbine and process-water treatment system by exploiting a private cellular network — marking the first known real-world attack through this vector.

The incident highlights a dangerous blind spot in critical infrastructure security: the private access point networks that grid operators rely on to reach remote equipment can become attack highways when misconfigured. With 50,000 residents depending on the plant for heat and the attack unfolding on Christmas Day, the stakes could hardly have been higher.

---

How Attackers Moved From a Wind Farm to a Power Plant

CERT Polska disclosed the incident on August 8, 2026 — more than three months after opening its investigation. Poland's prime minister had referenced two affected combined heat and power (CHP) plants in January. This disclosure covers the second.

The attack chain began at a wind farm entirely separate from the CHP plant. A FortiGate device at the wind farm served as both firewall and VPN concentrator. Its VPN was exposed to the internet and permitted accounts without multi-factor authentication. The attacker gained administrative privileges and likely harvested VPN credentials granting access to all network segments.

Understanding how network firewall configurations can be hardened against lateral movement is increasingly critical for operators managing distributed infrastructure like this — where a single misconfigured device can expose an entire estate.

From there, the route into the power plant ran through a private APN — a dedicated cellular data network managed by the distribution system operator. A configuration flaw allowed any device on that APN to communicate with any other. That single oversight let the attacker pivot from the compromised wind farm network directly to a controller at the CHP plant.

CERT Polska described this as "the first instance of this attack vector being observed in a real-world cyberattack."

The cellular router involved was a Teltonika RUTX50. Its default password had been changed during deployment. Investigators recovered repeated successful SSH logins but could not determine how the attacker obtained the password. As of August 11, no known unauthenticated vulnerability in the router's firmware explains the access. An unpublished flaw cannot be ruled out.

---

A Step-by-Step Campaign That Needed No Malware

The attack unfolded methodically across nearly two weeks — and its most significant characteristic was its deliberate, tool-light execution. Every destructive action exploited a supported device function invoked over protocols the plant already ran. No malware was deployed at any stage.

The reconnaissance phase

Starting December 18, the attacker scanned the APN and discovered a WAGO PFC200 controller exposing its web administration interface with default admin credentials still in place.

On December 25, the attacker connected to three Siemens PLCs over the S7 protocol — activity CERT assessed as reconnaissance for the later destructive phase. The choice of Christmas Day was almost certainly deliberate, exploiting reduced staffing and slower incident response times across the holiday period.

The destructive phase

On December 29, the main attack window ran from approximately 5:30 a.m. to 10:10 a.m. Plant recovery began at 7:30 a.m. while the attacker was still active inside the network. The following actions were taken:

• Siemens S7-300, S7-1200 and S7-1500 controllers were switched to STOP mode and password-protected
• Seven Moxa serial device servers and three network switches were factory-reset and assigned unreachable IP addresses, including 127.0.0.1
• CERT assessed the timing as indicating with high confidence that those actions were automated

Covering the tracks

The attacker then methodically erased the entry points. The WAGO controller's partition table was corrupted, leaving it unable to boot. The Teltonika router was factory-reset and assigned an unreachable address. The FortiGate was also factory-reset, destroying its logs.

CERT noted that RutOS versions earlier than 7.07 retained their event database after a factory reset — which is why SSH login records survived to aid investigators. That detail proved critical to reconstructing the timeline.

The plant did not immediately recognise the event as an attack. Maintenance was already underway and operators initially logged the outage as probable contractor error. CERT opened an incident because it was already aware of similar events from the broader December campaign.

---

Default Credentials and Shared Networks Created the Opening

CERT Polska's investigation identified a cluster of security failures that combined to create the attack path. No single vulnerability caused this incident — it was the accumulation of deferred decisions and unverified assumptions that opened the door.

Where the security model broke down

The WAGO controller reachable through the APN still carried default admin credentials. The private APN permitted client-to-client traffic with no isolation between connected devices. The wind farm's FortiGate VPN required no multi-factor authentication. And critically, the distribution system operator's requirements for the substation connection governed only how data travelled — not how the device carrying that data was administered.

CERT's surveys found that Polish organisations running private APNs commonly allow any device on the network to reach any other. The agency believes similar configurations are widely deployed in other countries. For operators who rely on cellular networks as part of their remote infrastructure, this case is a direct signal that network architecture assumptions need revisiting.

The guidance gap

Those findings create a broader concern. A July 30 FBI and EPA advisory on attacks against internet-facing water-sector PLCs lists private APNs among the isolated architectures operators should consider for reaching OT equipment. That guidance may need revisiting in light of this incident.

A misconfigured APN does not function as a security boundary — it functions as an attack corridor. Policy and compliance teams referencing this CERT Polska disclosure should treat it as grounds to challenge any framework that positions private APNs as an inherently safe isolation control without specifying configuration requirements.

For teams working through the broader implications, a structured approach to technology risk management provides a framework for identifying where vendor-defined connectivity requirements leave administrative security gaps — exactly the kind of gap exploited here.

What investigators recommended

CERT's recommendations address the configuration failures directly:

• Audit private APN configurations and enable client isolation as the immediate priority
• Treat the APN as untrusted from the operational technology side
• Segment and restrict traffic across APN-connected infrastructure
• Remove unnecessary management services from APN-reachable interfaces
• Replace default credentials across all connected devices

No threat actor has been named in connection with this specific intrusion. Four separate assessments of the broader December campaign were published in January by Poland's government, CERT Polska, ESET and Dragos. None addresses this particular incident directly. For further technical context on the ICS attack methodology, the ICS-CERT advisories published by CISA provide an authoritative reference for known vulnerabilities across industrial control system environments.

Customers lost neither heat nor electricity despite the turbine shutdown. The rapid recovery masked the attack's severity — and nearly prevented investigators from recognising it as one. That near-miss is itself a warning: when an attack is fast enough, clean enough and well-timed enough, it can pass for an accident until the window to contain it has already closed.

---

How You Can Act on This Information

For OT and ICS security teams: Immediately audit any private APN configurations in your environment and verify that client isolation is enabled. Treat cellular management networks with the same scrutiny as internet-facing infrastructure.

For critical infrastructure operators: Review vendor-issued requirements governing remote connectivity. Requirements that define data protocols but leave device administration unaddressed leave exploitable gaps — as this incident demonstrated.

For policy and compliance teams: Reference this CERT Polska disclosure when evaluating guidance that recommends private APNs as an isolation control. This case establishes that a misconfigured APN can function as an attack corridor rather than a security boundary.