Poland Reports Surge in Cyberattacks and Destructive Energy-Sector Attack
Summary
Poland reported 270,000 cyberattacks in 2025. Officials described a Dec. 29 destructive attack on a heat-and-power plant and renewable sites; electricity supply continued. CERT and ESET analyses pointed to possible Russian-linked actors, but no culprit was publicly ind[
Key points
- Poland’s deputy digital affairs minister said the country faced 270,000 cyberattacks in 2025, 2.5 times the previous year’s total.
- Coordinated attacks on Dec. 29 hit a heat-and-power plant serving almost 500,000 customers and multiple wind and solar farms.
- Electricity supply was not disrupted, but officials said the destructive attack could have threatened grid stability if larger energy units had been targeted.
- CERT Polska published technical details and said infrastructure used in the incident had previously been used by the Dragonfly threat actor.
- ESET assessed that the data-wiping malware and its deployment were likely associated with Sandworm; Polish authorities have not publicly identified a culprit.
Article Details
- Victim Organization
- Not disclosed
- Victim Domain
- Not disclosed
- Incident Type
- Destructive cyberattack against a combined heat and power plant and multiple wind and solar farms
- Incident Date
- 2025-12-29
- Operational Impact
- Electricity supply was not disrupted. The attack targeted facilities supplying heat to almost 500,000 customers; officials said attacks on larger energy units could have affected grid stability.
- Ransom Or Extortion
- Officials said the attack had no financial motivation and was intended to cause destruction. No ransom or extortion was reported.
- Claim Status
- confirmed
MITRE ATT&CK
People
Anton CherepanovESET senior malware researcher who analyzed the malware and said the data-wiping malware and its deployment were techniques commonly employed by Sandworm.Marcin DudekHead of CERT Polska, which published technical details of the energy-sector incident; he described the attack as destructive and a significant escalation.Paweł OlszewskiPoland's Deputy Minister of Digital Affairs, who reported that the country faced 270,000 cyberattacks in 2025.
Threat Actors
DragonflyCERT Polska found that infrastructure used in the Polish attack had previously been used by Dragonfly. Its involvement in this attack was not confirmed.SandwormESET assessed that Sandworm was likely responsible for the Polish attack, citing the use and deployment of data-wiping malware; this attribution was not confirmed.Static TundraThe article identifies Static Tundra as another name for Dragonfly. Infrastructure used in the attack had previously been used by Dragonfly, but responsibility was not confirmed.
Countries
PolandPoland experienced 2½ times more cyberattacks in 2025 compared to the previous year, and the numbers are constantly rising, a government official said Tuesday.RussiaThe attacks included a destructive infiltration of the country’s energy system in December that was believed to be unprecedented among NATO and European Union members, and was suspected of originating in Russia.