Hackers Hit Polish Power Plant via Private Cellular Network, Shut Turbine

Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power (CHP) plant serving roughly 50,000 residents by pivoting through a private cellular network used by the local grid operator. CERT Polska disclosed the December 2025 incident on August 8, 2026, more than three months after the breach was first detected. Recovery began at approximately 7:30 a.m. while intruders remained active inside the network, though no customers lost heat or electricity. Poland's prime minister had referenced two CHP plants being hit in January; this report confirms the second.

The attack path began at a wind farm where a FortiGate device functioned as both firewall and VPN concentrator. Its VPN was exposed to the internet and allowed accounts without multi-factor authentication, giving the attacker administrative privileges and likely credentials to reach all network segments. From there, the attacker traversed a private APN—an access point name serving as a dedicated cellular data network for the distribution system operator—into a WAGO controller at the CHP plant. The configuration permitted arbitrary client-to-client communication across the APN, enabling the pivot from a compromised wind-farm network into industrial control systems. CERT Polska noted this was likely the first real-world cyberattack observed traversing a private APN into an OT environment.

The technical breakdown reveals a cascade of configuration failures rather than a single exploit. The WAGO controller reachable through the APN still carried default admin credentials—a basic oversight that organizations can address immediately by running their credentials through a password checker. The Teltonika cellular router's management interface sat on a separate VLAN via an Ethernet port with no equivalent protocol restrictions like DNP3.0, which governed the substation's RTU. No CVE has been tied to the intrusion, and investigators could not confirm whether a vulnerability in the Teltonika router was exploited. The SSH service, controller web interface, and permissive APN all functioned exactly as configured—demonstrating how default settings and configuration drift can compromise critical infrastructure without sophisticated tooling.

CERT's core recommendations center on auditing private APN configurations and enabling client isolation, treating the APN as untrusted from the OT side, segmenting and restricting traffic, removing unnecessary management services from APN-reachable interfaces, and changing default credentials everywhere. The agency found that Polish organizations running private APNs commonly allow any device on the network to reach any other—and it believes similar deployments are widespread internationally. With the initial VPN entry point exposed to the public internet, defenders should also run a port scanner to identify unintended exposure on management interfaces and use a VPN/proxy detector to verify that sensitive appliances are not leaking through anonymizing services.