The cybersecurity of critical infrastructures has become a priority for many countries, with increasingly sophisticated attacks targeting essential sectors such as energy. At the end of December 2025, Poland had to face an attempted cyber sabotage that, if successful, could have had significant consequences for hundreds of thousands of people.
On December 29 and 30, 2025, a cyber attack targeted the Polish energy sector, specifically two combined heat and power (CHP) plants that produce both electricity and heat, and a management system for electricity from renewable sources, including wind turbines and solar plants. The attackers used a type of malware called “DynoWiper”, designed to erase critical data and cause disruptions in systems. Fortunately, the attack was detected and neutralized in time, preventing any service interruption or damage to infrastructures.
According to analysis conducted by the cybersecurity company ESET, there are elements that suggest with medium certainty the involvement of “Sandworm”, a hacker group linked to the GRU, the Russian military intelligence agency. This group is known for having conducted similar operations against critical infrastructures in other countries in the past.
The importance of this incident should not be underestimated. If the attack had been successful, it could have caused blackouts and heating interruptions for approximately 500,000 people. Considering that the incident occurred in the middle of winter, the consequences could have been particularly severe for the affected population.
This attempted attack highlights the importance for companies in the energy sector and critical infrastructures to continuously strengthen their cyber defenses. It is essential to implement early detection systems, regularly perform security updates, train personnel on recognizing potential threats, and develop incident response plans. Collaboration between the public and private sectors is also essential to share information about emerging threats and coordinate responses.
Key points to remember:
– Cyber attacks on energy infrastructures represent a concrete and evolving threat, with potential consequences for national security and citizens’ well-being.
– Timeliness in detecting and responding to attacks is crucial; in the Polish case, rapid intervention prevented potentially serious consequences for half a million people.
– Cybersecurity requires a proactive and collaborative approach, with continuous investments in technologies, training, and international cooperation.
Sources:
https://www.zetter-zeroday.com/cyberattack-targeting-polands-energy-grid-used-a-wiper/
https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html
https://techcrunch.com/2026/01/23/researchers-say-russian-government-hackers-were-behind-attempted-poland-power-outage/
Source: BleepingComputer