What happened

A later technical disclosure described a destructive intrusion into a smaller Polish combined heat and power plant serving roughly 50,000 residents during the wider 29 December 2025 energy-sector campaign. According to reporting based on CERT Polska's investigation, the attacker first compromised infrastructure at a separate wind farm, reached a Teltonika router attached to a private cellular APN that allowed client-to-client communication, scanned that network and pivoted through a WAGO PFC200 controller whose web interface retained default administrator credentials. After reconnaissance on 25 December, the attacker reportedly placed Siemens S7-300, S7-1200 and S7-1500 controllers into STOP mode and password-protected them on 29 December, stopping a steam turbine and the plant's process-water treatment system. Moxa serial servers and switches were also reset or made unreachable. No bespoke malware was required because legitimate device functions and existing industrial protocols were abused. Operators initially mistook the interruption for contractor error during maintenance. Customers reportedly lost neither heat nor electricity. The plant and its location were withheld, so the marker is a country-level reference. This is kept separate from the larger CHP plant serving nearly 500,000 customers, where CERT Polska said endpoint protection blocked the attempted wiper deployment; the reviewed follow-up reporting links both to the broader campaign but does not provide a public facility identity or an independently adjudicated attribution for this smaller plant.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.