Polish Agency Reports ICS Breaches at Five Water Treatment Facilities
Summary
Poland’s ABW reported 2025 ICS breaches at five water treatment stations. In some cases, attackers could alter equipment parameters; weak passwords and internet exposure were identified as primary attack vectors.
Key points
- ABW recorded breaches at water treatment stations in Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo during 2025.
- In some cases, attackers gained ICS access that could let them modify equipment parameters, posing risks to operational continuity and water supply.
- ABW identified weak password policies and systems exposed directly to the internet as the primary attack vectors.
- The agency reported increased attacks on supply chains, critical infrastructure, wastewater treatment plants, and waste incineration facilities.
- Supply-chain attackers sought contract data, project documentation, and authentication credentials that could enable downstream access.
- ABW attributed primary responsibility to hacktivist groups and named APT28, APT29, and Belarusian-linked UNC1151 as operating against Polish targets.
Article Details
- Event Type
- Reported cyber intrusions into industrial control systems at five Polish water treatment stations, alongside attacks targeting supply chains and other municipal utilities.
- Impact
- In some incidents, attackers gained access to industrial control systems and could modify equipment parameters, posing risks to operational continuity and public water supplies. Supply-chain attacks sought contract data, project documentation, and authentication credentials that could enable downstream system access.
Threat Actors
APT28The report names APT28 as operating against Polish targets; this attribution is reported by the agency.ICE RELICThe report names APT29 as operating against Polish targets; this attribution is reported by the agency.UNC1151The report identifies UNC1151 as Belarusian-linked and operating against Polish targets; this attribution is reported by the agency.
Countries
PolandPoland’s Internal Security Agency (ABW) has documented a significant escalation in cyberattacks targeting industrial control systems (ICS) and other operational technology (OT) infrastructure during 2024 and 2025, withRussiaThese are longstanding OT security hygiene failures, and they were also recently leveraged in a Russia-linked attack on Polish energy facilities.
Industries
EnergyThese are longstanding OT security hygiene failures, and they were also recently leveraged in a Russia-linked attack on Polish energy facilities.Wastewater treatmentsupply chains, critical infrastructure, and ICS at other types of municipal utilities, including wastewater treatment plants and waste incineration facilities.