INCIDENT REPORT · CP-2025-023

Destructive attack on Poland's energy sector

L3 · ELEVATEDCONFIRMED

Coordinated attacks on 29 December 2025 damaged remote-control equipment at more than 30 Polish wind and solar farms and attempted to deploy DynoWiper at a large combined heat and power plant, according to CERT Polska.

Incident ID: CP-2025-023
Incident date: 29 DEC 2025
Detection date: 29 DEC 2025
Affected countries: Poland
Plotted location: Poland (Country-level (specific facility locations not publicly disclosed))
Threat classification: Level 3 — ELEVATED
Classification rationale: Destructive state-linked attack on energy infrastructure; physical supply was not interrupted.
Attack type: Wiper / Destructive Malware
Nature: Malicious activity
Attack vector: Compromise of internet-facing edge devices (reported FortiGate) at renewable sites; wiper spread via Active Directory/PowerShell at a CHP plant
Sectors: Energy, Manufacturing
Critical infrastructure: Yes
Organizations affected: 30+ wind and solar farms, A combined heat and power plant, A manufacturing company
Operational consequences: Renewable sites lost remote communication with the distribution operator though generation continued; the wiper at the CHP plant was stopped by EDR and heat supply was not disrupted. UK officials said a successful attack could have left about 500,000 people without power.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the UK and EU (13 July 2026) to Centre 16 of Russia's FSB; ESET separately linked the DynoWiper malware to Sandworm with medium confidence

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Destructive attack on Poland's energy sector

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2025-023

Incident date

29 DEC 2025

Detection date

29 DEC 2025

Affected countries

Poland

Plotted location

Poland (Country-level (specific facility locations not publicly disclosed))

Threat classification

Level 3 — ELEVATED

Classification rationale

Destructive state-linked attack on energy infrastructure; physical supply was not interrupted.

Attack type

Wiper / Destructive Malware

Nature

Malicious activity

Attack vector

Compromise of internet-facing edge devices (reported FortiGate) at renewable sites; wiper spread via Active Directory/PowerShell at a CHP plant

Sectors

Energy, Manufacturing

Critical infrastructure

Yes

Organizations affected

30+ wind and solar farms, A combined heat and power plant, A manufacturing company

Operational consequences

Renewable sites lost remote communication with the distribution operator though generation continued; the wiper at the CHP plant was stopped by EDR and heat supply was not disrupted. UK officials said a successful attack could have left about 500,000 people without power.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the UK and EU (13 July 2026) to Centre 16 of Russia's FSB; ESET separately linked the DynoWiper malware to Sandworm with medium confidence