Cyberattack on Poland’s Power Grid: How Outdated Devices Opened the Door to Hackers

The stability of energy infrastructure directly depends on the level of its cybersecurity. This is especially true for distributed energy resources (DER), which are increasingly integrated into digital environments and require reliable management and control. 

At the end of 2025, an incident in Poland’s power grid demonstrated how even individual vulnerabilities can affect the controllability of infrastructure. As a result of the cyberattack, monitoring and control systems were disrupted, leading to a loss of remote control over part of the facilities. 

This case became significant for the entire industry, as the attackers targeted distributed energy resources—solar and wind power plants, as well as small generating facilities, which, due to their decentralized architecture, often have varying levels of security. 

Modern energy systems are based on a combination of IT and OT systems that ensure monitoring, management, and uninterrupted operation of assets. At the same time, such integration requires a well-designed secure architecture, strict access control, and regular infrastructure updates. 

In this incident, edge devices served as the entry point, as they did not meet basic cybersecurity requirements. The use of outdated equipment, the absence of multi-factor authentication (MFA), and the use of default credentials allowed initial access to the network. 

Further progression of the attack was made possible due to insufficient segmentation between IT and OT environments, as well as inadequate access control to critical systems. 

As a result:

• Monitoring systems were disrupted; 
• Access to HMI (operator panels) was lost; 
• Part of the controllers were compromised; 
• The stability of the network infrastructure was impacted. 

A particular focus in this case should be placed on the key factors that contributed to the incident:

• The use of outdated or unsupported edge devices. 
• The presence of default or weak passwords. 
• The absence of multi-factor authentication (MFA). 
• Insufficient network segmentation between IT and OT environments. 
• The lack of continuous network traffic monitoring. 
  
  

The incident demonstrated that even without a physical power outage, a cybersecurity breach can significantly impact the operational resilience of infrastructure and complicate the management of energy assets. 

The implementation of modern cybersecurity approaches — including network segmentation, access control, equipment updates, and monitoring systems — can significantly reduce the risk of similar incidents. 

Cybersecurity is an integral component of reliable energy operations and a guarantee of business continuity in today’s environment.