Cyberattacks on Polish energy infrastructure attributed to Russia
The EU and UK officially attributed a late 2025 cyberattack on Poland's energy grid to Russia's FSB, Center 16 division, on July 12, 2026, marking the first coordinated package of cyber sanctions against Russian hackers. As of July 12, 2026, the attack, which attempted to deploy destructive DynoWiper malware, was unsuccessful in causing widespread disruption but came close to cutting heating for half a million people. Poland's Foreign Minister Radosław Sikorski warned of impending Russian cyberattacks, and intelligence indicates Russia has also targeted Poland's water infrastructure, with breaches confirmed at five facilities in 2025. Polish authorities attribute these sophisticated operations, which utilized wiper malware and targeted renewable energy sources, to Russian state-sponsored groups like Sandworm and Static Tundra, part of a 2.5-fold increase in cyberattacks against Poland in 2025.
Timeline
Want updates on this thread?
Track this storyTimeline of developments
July 2026 — 4 developments
EU and UK Impose Cyber Sanctions on Russia Over Poland Energy Grid Attack
The EU and UK officially attributed a late 2025 cyberattack on Poland's energy grid to Russia's FSB, Center 16 division, on July 12, 2026. This action marks the first coordinated package of cyber sanctions imposed against Russian hackers. The attack, which attempted to deploy destructive DynoWiper malware, was unsuccessful in causing widespread disruption but came close to cutting heating for half a million people.
Poland Warns of Impending Russian Cyberattacks and Provocations
Poland's Foreign Minister Radosław Sikorski warned of impending Russian cyberattacks and provocations, citing credible intelligence. This follows a December 2025 cyberattack on Poland's energy grid attributed to the Russian APT group Sandworm. The warning highlights a potential escalation of Russian hybrid warfare.
Russia Targets Poland's Water Infrastructure After Energy Grid Cyberattacks
Intelligence warnings indicate Russia has targeted Poland's water infrastructure following severe cyberattacks on its energy grid in December 2025. These energy sector attacks, described as the most severe ever recorded, were a deliberate attempt to destabilize Poland. CERT Polska attributes the attacks to Russian-linked threat groups, including Static Tundra, utilizing wiper malware.
Russia-Linked Hackers Targeted Polish Water Plants in 2025 Campaign
The Polish Internal Security Agency (ABW) has detailed a campaign targeting water plants, with breaches confirmed at five water treatment facilities in 2025, suspected to be carried out by Russia-linked APT groups. This suggests a sustained Russian hybrid warfare campaign against Polish critical infrastructure, with attacker activities beginning between March and May 2025.
June 2026 — 2 developments
Poland Conducts 'Blackout 2026' Drill Following Russian Cyberattack on Energy Grid
In June 2026, Poland conducted a "Blackout 2026" drill to test its response to physical attacks on critical power infrastructure, following a late 2025 cyberattack on its energy grid. Polish authorities attributed the sophisticated operation, which targeted renewable energy sources and deployed wiper malware, to Russian state-sponsored hackers, likely the Sandworm group. Despite the attack coming close to causing a widespread blackout, Polish defense systems successfully repelled the intrusions.
Poland Arrests Cybercrime Group Members Following Russian Energy Grid Attack
Polish authorities arrested members of a cybercrime group involved in SIM-swapping and cryptocurrency theft in June 2026, with support from U.S. agencies. This action follows a significant cyberattack on Poland's energy grid at the end of December 2025, which narrowly avoided a widespread blackout and is attributed to Russia.
May 2026 — 1 developments
Poland Boosts Cybersecurity Amid Russian-Linked Energy Sector Attacks
Poland has increased its cybersecurity budget and strengthened defenses in response to a significant surge in cyberattacks, largely attributed to Russian-backed hackers targeting its energy sector. Cybersecurity firms and Polish authorities have linked the prominent attack in late December 2025, which narrowly avoided a nationwide blackout, to Russian intelligence agencies, including Sandworm and Static Tundra.
April 2026 — 1 developments
CERT Polska Attributes Polish Energy Sector Cyberattack to Russian FSB-Linked 'Static Tundra'
CERT Polska has attributed the late December 2025 cyberattack on Poland's energy sector to the 'Static Tundra' cluster, also known as Berserk Bear or Dragonfly, which is associated with Russia's Federal Security Service (FSB). The sophisticated operation utilized wiper malware like DynoWiper to destroy data and corrupt systems, damaging equipment and degrading communication between energy entities.
March 2026 — 1 developments
Polish Authorities Suspect Russian Intelligence Behind 2025 Cyberattack on Energy Infrastructure
Polish authorities suspect Russian intelligence services are behind a major December 2025 cyberattack on energy infrastructure, which is part of a broader trend of a 2.5-fold increase in cyberattacks against Poland in 2025. The attack, which exploited vulnerable devices, is attributed to groups including APT28 (Fancy Bear) and Sandworm, and aimed at destabilization. Electricity supply remained uninterrupted.
February 2026 — 1 developments
CISA warns US critical infrastructure after Poland's energy grid cyberattack
Following a cyberattack on Poland's energy grid, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to U.S. critical infrastructure owners and operators. The advisory aims to share lessons learned from the attack, which targeted approximately 30 wind and solar farms.
January 2026 — 9 developments
Russian Hackers Breached Polish Energy Facilities, Deployed Wiper Malware
A technical report from Poland's CERT revealed that Russian government hackers breached Polish energy facilities by exploiting default credentials and a lack of multi-factor authentication. The attackers deployed wiper malware to destroy monitoring systems.
Russian Hacking Group ELECTRUM Launches First Major Cyberattack on Distributed Energy Resources
The cyberattack has been attributed to the Russian state-sponsored hacking group ELECTRUM, which shares overlaps with Sandworm. According to cybersecurity company Dragos, this was the first major cyberattack targeting distributed energy resources (DERs).
PSE CEO states cyberattack posed small long-term blackout risk, did not threaten critical infrastructure
The CEO of Polskie Sieci Energetycznych (PSE) stated that the risk of a long-term blackout from the cyberattack was small and that the attack on smaller renewable energy assets did not threaten critical infrastructure.
Cyberattack targets heat-and-power plants and renewable energy system with DynoWiper malware
The cyberattack specifically targeted two heat-and-power plants and a renewable energy management system, and the DynoWiper malware used was previously undocumented.
Cyberattack Targets Poland's Energy Grid Communications
The cyberattack on Poland's energy grid specifically aimed to disrupt communications between renewable energy installations and electricity distribution operators.
ESET attributes Polish energy cyberattack to Russian Sandworm hackers using 'DynoWiper' malware
European security firm ESET reported that the December cyberattack on Polish energy targets used 'DynoWiper' malware, designed to erase computers and cause disruption. ESET attributed the operation with medium confidence to Sandworm, a Russian military intelligence hacking unit.
Poland's Digital Affairs Minister Reports Russia Tripling Cyberattack Resources Against Poland
Poland's digital affairs minister reported that the country faces between 2,000 and 4,000 cyber incidents daily, with 700 to 1,000 posing a real threat, and that Russia has tripled its resources for cyber actions against Poland in 2025. The recent attack on the energy grid breached systems through vulnerable edge devices before deploying wiper malware that damaged operational technology and corrupted firmware.
Poland Accuses Russia of Major Cyberattack on Energy Grid
Poland has accused Russia of launching a major cyberattack on its energy grid in late December 2025, which nearly caused a nationwide blackout. Energy Minister Miłosz Motyka stated the attack aimed to disrupt communication between renewable energy installations and power distribution operators. The UK's National Cyber Security Centre also issued an alert following these attacks, attributed to Russian state cyber forces.
Polish Energy Minister Motyka announces 'anti-blackout package' after 'threatening' December attacks
Polish Energy Minister Miłosz Motyka stated that the December attack was 'threatening' and different from previous attacks, as various locations were targeted simultaneously. He announced Poland would increase investment in energy infrastructure through an 'anti-blackout package'.
December 2025 — 1 developments
Poland Thwarts Russian Cyberattack on Energy Grid, Preventing Blackout
Poland thwarted a significant and coordinated cyberattack targeting its energy grid, specifically two combined heat and power plants, which aimed to cause a blackout affecting hundreds of thousands of people. Polish officials attributed the attack to Russian intelligence services.
October 2025 — 1 developments
Poland's Digital Affairs Minister reports Russia tripled cyber resources targeting Poland
Poland's Digital Affairs Minister Krzysztof Gawkowski reported a surge in cyberattacks linked to Russia, with Moscow's military intelligence tripling its cyber resources targeting Poland. Of 170,000 cyber incidents in the first nine months of 2025, a substantial share was attributed to Russian actors, with attackers extending their reach to the energy sector.
September 2025 — 1 developments
Russian-linked bots spread disinformation blaming Ukraine after cyberattack and drone strike
A coordinated cyberattack, described as the largest digital assault since 2022, coincided with a Russian drone strike. Russian-linked bots subsequently spread disinformation blaming Ukraine.
August 2025 — 1 developments
Hackers attempted to disable a Polish hydroelectric power station near Gdańsk
Hackers attempted to disable a hydroelectric power station in Poland's Pomeranian Voivodeship near Gdańsk by manipulating operational parameters to extreme values, forcing a shutdown of the generator and rotor.