Devices and control systems: Energy and utilities, Poland 2025
On 29 December 2025, a coordinated wave of attacks disrupted the IT and operational technology of around 30 wind and solar parks, a large combined heat and power plant and a manufacturing company in Poland.
- Incident · 12.2025 · Poland
- Evidence: confirmed by an authority
- Devices and control systems
- Malware
As of
What happened
The attackers got in via remote access without MFA and in some cases with factory passwords, damaged the firmware of control devices and deployed wiper malware. The NCSC describes the case as sabotage in the context of geopolitical tensions.
- Affected
- Company (anonymous)
- Industry
- Energy and utilities
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- no / no
- Data affected
- true
- Bankruptcy
- no
- Entry point
- Remote access without multi-factor authentication, unpatched vulnerabilities, default passwords
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Hardware that no longer starts after the attack
Mostly limited 5 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Factory passwords and remote access without MFA make control systems an easy target, including for sabotage.
Sources
- Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window) Bundesamt für Cybersicherheit BACS · 2026-08
«In mehreren Fällen waren auf den Geräten noch die werkseitigen Standardpasswörter des Herstellers eingestellt.»