An Attack Timed to the Cold

Between December 29 and December 30, 2025, Poland experienced what Polish and international security researchers have since described as the largest cyberattack on the country's energy infrastructure in years — and one of the first large-scale, coordinated cyberattacks specifically targeting distributed energy resources such as wind and solar farms. The timing was notable: the attack unfolded as Poland faced cold temperatures and snowstorms, a period when disruptions to heating and power infrastructure would carry the highest possible civic impact.

According to CERT Polska, the country's national computer emergency response team, the coordinated intrusion affected more than 30 wind and photovoltaic (solar) farms, a private manufacturing company, and a large combined heat and power plant that supplies heat to nearly 500,000 customers. The scale and coordination across dozens of separate facilities in a single campaign window set this incident apart from more typical single-target industrial control system attacks.

How the Attackers Got In

Subsequent investigation, detailed in a CERT Polska incident report and corroborated by reporting from TechCrunch and Help Net Security, found that the attackers gained initial access through vulnerable, internet-facing edge devices — reported to include exposed VPN access points and FortiGate-managed network equipment tied to the wind and solar sites. Security researchers who reviewed the incident were notably blunt about the state of the targeted systems' defenses: many relied on default usernames and passwords and lacked multi-factor authentication, described by multiple outlets as "basic" security failures for infrastructure of this sensitivity.

Once inside, the attackers deployed wiper malware — destructive software designed not to steal data quietly but to actively destroy it and disrupt operations. The malware destroyed data on human-machine interfaces (HMIs, the control panels operators use to monitor and manage plant equipment), corrupted firmware on operational technology (OT) devices, and damaged remote terminal units (RTUs), which serve as a critical communication link between field equipment and central control systems.

Impact: Disruption Without Blackout

The practical effect of the attack was a loss of visibility and control between the affected renewable energy facilities and their distribution system operators — meaning grid operators temporarily lost the ability to monitor and remotely manage these sites. However, according to both CERT Polska's assessment and subsequent statements from Polish officials, the attack did not succeed in disrupting the actual production or delivery of electricity, nor did the attack on the combined heat and power plant succeed in cutting off heat supply to the customers depending on it during the cold snap.

Poland's Prime Minister Donald Tusk briefed government leaders on the incident on January 14, 2026, characterizing the attack as having been thwarted and stating that the broader energy system was never genuinely at risk of a widespread blackout — while simultaneously acknowledging that the episode revealed a need for substantially enhanced IT and OT security protections as Poland works to implement new national critical-infrastructure resilience measures.

Attribution to a Russian-Linked Group

Polish authorities concluded that the infrastructure and techniques used in the attack overlapped significantly with those associated with the Dragonfly hacking group — also tracked in the security industry under the names Static Tundra, Berserk Bear, and by industrial-control-system security firm Dragos as ELECTRUM. Dragonfly/Static Tundra has been publicly linked by Western intelligence assessments to Russia's Federal Security Service (FSB), specifically to a unit identified as Center 16. The group has a long history dating back more than a decade of targeting energy-sector organizations across Europe and North America, both for espionage and, in some cases, for pre-positioning capable of enabling future disruptive attacks.

International Response and CISA Warning

The incident's implications extended well beyond Poland's borders. In the weeks following disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a formal alert to American critical infrastructure owners and operators, using the Polish incident as a case study to highlight security gaps common across operational technology and industrial control system environments — particularly around internet-exposed remote access equipment, weak or default credentials, and the absence of multi-factor authentication on systems that control physical infrastructure. UK cybersecurity agencies issued parallel warnings, reflecting shared concern among NATO-aligned governments about the applicability of the attack's techniques to their own renewable energy and grid infrastructure.

Remediation and Recommendations

In the aftermath, Polish authorities and independent security researchers converged on a similar set of recommendations for energy operators, particularly those managing distributed renewable energy assets that are often less centrally monitored than traditional large power plants:

• Eliminating direct internet exposure of VPN gateways, firewalls, and other edge devices used to manage OT environments, or at minimum placing them behind additional network segmentation and monitoring
• Enforcing multi-factor authentication across all remote access paths into industrial control and OT management systems, closing off one of the most basic gaps exploited in this attack
• Replacing default vendor credentials on all field and control equipment as a mandatory step during deployment, not an optional hardening measure
• Increasing monitoring and anomaly detection specifically for smaller, distributed generation sites (wind and solar farms), which have historically received less security investment than large centralized power plants
• Developing incident response and manual-operation fallback procedures specifically for scenarios where remote visibility and control are lost, given that this was the primary operational impact of the December attack

The Polish grid attack has since become a widely referenced case study in industrial cybersecurity circles, both as an example of the growing willingness of state-linked actors to target distributed renewable energy infrastructure, and as a reminder that even a technically ambitious, coordinated attack can be substantially blunted when core production and delivery systems retain resilience — while also underscoring how much room for improvement remains in securing the remote access layer that increasingly connects modern grid equipment to the internet.