Poland Power Grid Attack Targets Distributed Energy Facilities
Summary: On December 29, 2025, a cyber attack targeted operational technology at multiple sites across Poland's electrical grid, including wind farms, solar installations, and combined heat and power facilities, and Prime Minister Donald Tusk briefed government leaders on it on January 14, 2026. Dragos, involved in incident response alongside CERT Polska, assesses with moderate confidence that the threat group ELECTRUM - which overlaps with Sandworm and has attacked electrical infrastructure since 2015 - is responsible, and calls it the first major coordinated attack on distributed energy resources at scale.
Why it matters: ELECTRUM compromised RTUs, network devices, and communications links across numerous sites at once by exploiting common connectivity patterns and repeated vulnerabilities - access that did not produce operational impact this time but is the kind of foothold that could if the group learns specific site configurations or reaches more sites simultaneously.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026