Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
Summary: Attackers reached a Polish combined heat and power plant over the distribution operator's private cellular APN, pivoting from a compromised wind-farm network to a WAGO controller with default admin credentials, then switched Siemens S7-300, S7-1200 and S7-1500 controllers to STOP mode and password-protected them on December 29, shutting down a steam turbine and the process-water treatment system. CERT Polska disclosed the December 2025 incident on August 8 after a three-month investigation and called reaching an industrial control network through a private APN the first observed real-world instance of that attack vector; the plant supplies heat to roughly 50,000 residents, who lost neither heat nor electricity.
Why it matters: Every destructive step used a supported device function over the plant's own protocols, with no malware and no CVE to patch, so the fix is configuration: client isolation on the APN, no default credentials, and no management interfaces reachable from it. CERT's surveys found Polish organizations running private APNs commonly let any device reach any other, and it believes similar configurations are widely deployed elsewhere - while a July 30 FBI and EPA advisory still lists the private APN as an isolation option for water-sector operators.
Read the original at The Hacker News ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2023-32349CVE-2023-32350
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026