Cyberattacks and hybrid warfare threats in Poland

Cyberattacks have targeted Poland’s energy infrastructure, specifically targeting wind and solar farms, manufacturing firms, and heating plants. Experts from CERT Polska have linked these destructive incidents to groups believed to be associated with the Russian FSB, including “Berserk Bear,” “Static Tundra,” “Dragonfly,” and “Ghost Blizzard.”

Technical investigations into a breach at a combined heat and power (CHP) plant serving approximately 50,000 residents revealed that attackers exploited a private Access Point Name (APN) within a mobile telecommunications network. This exploit allowed intruders to bypass traditional internet-based defenses and pivot into operational technology (OT), industrial control systems (ICS), and SCADA networks. The breach resulted in the shutdown of a steam turbine and process water treatment systems.

Recent developments indicate a broader surge in threats against Polish critical infrastructure. Local Internet Service Providers have reported unprecedented Distributed Denial of Service (DDoS) attacks, with some traffic reaching 260 Gb/s. Additionally, an audit by the Supreme Audit Office (NIK) revealed critical vulnerabilities in energy, water, and transport sectors, noting that many operators failed to ensure data integrity or ignored security alerts. National Computer Security Incident Response Teams reported nearly 273,000 incidents in 2025, representing a 144.4% increase from the previous year.

Authorities have also warned of heightened hybrid warfare risks. Security services reportedly prevented a major energy infrastructure attack in late December that could have caused a blackout affecting at least 500,000 people. Furthermore, investigations are underway into a fire at WB Electronics in Skarżysko-Kamienna, where officials are exploring potential Russian espionage following an attack on the facility, which produces drones for the Ukrainian military.