A wiper blocked, a heat supply kept: how close did Poland come to a cyber-blackout?

At a large combined heat and power plant that supplies heat to almost half a million customers in Poland, the attackers had already done the hard part. They had spent a long time inside the network, stolen operational information and obtained privileged accounts. Then they tried to run malware designed to destroy data irreversibly. "Its operation was blocked by the EDR software used by the organization," CERT Polska, Poland's national computer emergency response team, wrote.

The attack, on 29 December 2025, did not achieve its goal of disrupting heat supply to end users, CERT Polska said. Elsewhere it did damage: at more than 30 wind and photovoltaic farms, devices were wrecked and the sites lost communication with the distribution system operator.

It came in mid-winter, ten years after the first malware-caused blackout, in Ukraine in December 2015. For a country that borders the war and is rebuilding its grid around renewables, it is a test case of how distributed energy can be attacked — and defended.

What did the attackers hit?

CERT Polska's report, published on 30 January 2026, lists three kinds of target: grid connection substations at more than 30 wind and solar farms, the heat and power plant, and a private manufacturing company hit opportunistically with the same wiper.

At the farms, the attackers performed reconnaissance and then went after remote terminal units, local operator panels, protection relays and communication devices. They corrupted firmware, deleted system files and deployed wiper malware, so the stations lost communication with the operator and remote control. Even so, the attacks "did not affect the ongoing production of electricity," CERT Polska said.

The government's account, reported by Help Net Security, describes the targets as two combined heat and power plants and a system that manages electricity from wind turbines and photovoltaic farms, attacked on 29 and 30 December.

Who is behind it — and why do the answers differ?

Prime Minister Donald Tusk said: "Everything indicates that these attacks were prepared by groups directly linked to the Russian services," Help Net Security reported.

The security company ESET named the malware DynoWiper and attributed the attack "to the Russia-aligned Sandworm APT with medium confidence," its researcher Robert Lipovsky said, according to Infosecurity Magazine. Sandworm is thought to be part of Russia's GRU military intelligence. ESET based its assessment on overlaps with earlier Sandworm wiper activity, and Lipovsky said the timing, on the tenth anniversary of the 2015 attack on Ukraine's grid, might be deliberate. That attack used BlackEnergy malware and left around 230,000 people without power for several hours.

CERT Polska pointed elsewhere. It said the infrastructure used overlaps with a cluster tracked as "Static Tundra" by Cisco, "Berserk Bear" by CrowdStrike, "Ghost Blizzard" by Microsoft and "Dragonfly" by Symantec — and that this is "the first publicly described destructive activity attributed to this activity cluster." Its page does not name a Russian agency.

The difference matters less for defenders than for diplomacy: the same intrusion can be read as the work of one service or another, and each reading carries different signals.

Why did it fail?

"The systems we have in Poland today proved effective," Tusk said, adding: "At no point was critical infrastructure threatened," Infosecurity Magazine reported. He said transmission networks were not compromised. "We're not aware that any successful disruption occurred," Lipovsky said.

The plant was saved by endpoint detection software doing its job. The farms were not spared: their power kept flowing, but their link to the operator was cut — a reminder that in a grid made of many small sites, each one is a door.

What is Poland changing?

Tusk said Polish cyber defenders thwarted the attack but that energy systems must still be strengthened, Help Net Security reported. The ruling coalition is drafting a bill with stricter requirements for risk management, protection of IT and operational technology, and incident response. Tusk said he hopes to implement the National Cybersecurity System Act, Poland's transposition of the EU's NIS2 directive, "as soon as possible," and added: "We are striving for the autonomy and Polonization of security systems," according to Infosecurity Magazine.

What we do not know

• Who did it. The Polish government points to Russian services; ESET says Sandworm, with medium confidence; CERT Polska links the infrastructure to a different, long-known cluster. No attribution has been proven publicly.
• How many plants. CERT Polska describes one large heat and power plant; the government's account, as reported, describes two.
• The exact dates. CERT Polska dates the attacks to 29 December; other reports give 29–30 December.
• The intended impact. ESET said "details regarding the intended impact continue to be investigated."

What to watch

The real test is the law: whether Poland's NIS2 act passes and whether smaller renewable operators — the sites that lost communication — can meet stricter security rules. Watch, too, whether other European grid operators report similar intrusions. CERT Polska's full report, with indicators of compromise, is public; for any operator of wind, solar or heat plants, it is a checklist written by the attackers.

Sources

• CERT Polska — Incident report: energy sector, 2025 (30 January 2026)
• Help Net Security — Poland repels data-wiping malware attack on energy systems (26 January 2026)
• Infosecurity Magazine — Wiper attack on Polish power grid linked to Russia's Sandworm (January 2026)