Hackers Breach Polish Plant via Private Cellular Network

A cyberattack on a Polish combined heat and power plant in December 2025, initially mistaken for a contractor error, has been revealed as the first known instance of hackers using a private cellular network to breach an industrial control system. The incident, part of a broader coordinated assault on Poland's energy sector, targeted a facility supplying heat to approximately 50,000 residents and resulted in the shutdown of a steam turbine and water treatment system.

The attack occurred on December 29, 2025, the same day coordinated strikes hit over 30 renewable energy facilities and a larger CHP plant. The newly disclosed incident was not included in the initial public report in January 2026 because the investigation, led by Poland's Computer Emergency Response Team (CERT Polska), took more than three months to complete. CERT Polska disclosed the findings on August 8, 2026.

According to the investigation, the intrusion began at a wind farm, where attackers compromised a FortiGate VPN and firewall device exposed to the internet. From there, they accessed a Teltonika cellular router and used its SSH service to tunnel into a private Access Point Name (APN) managed by the local...