Compromised FortiGate VPN Opens First Step in Multi-Network Polish Energy Attack
Brief
Poland’s energy sector attack has revealed how one compromised remote-access device can become the first step in a wider industrial intrusion.
The campaign moved from a wind-farm network into a heat and power plant, turning trusted connectivity into disruption.
The incident occurred on 29 December 2025, alongside coordinated destructive attacks against more than 30 renewable facilities.
At the plant, the intrusion stopped a steam turbine and water-treatment system, interrupting cogeneration, though heat and electricity supplies to roughly 50,000 residents continued.
CERT.PL analysts identified the route after a three-month investigation of an apparent maintenance error.
Their findings show the attacker did not need to expose the plant directly to the internet; instead, they crossed networks through a private mobile data environment used for operational communications.