Wiper attack on Poland's energy sector was thwarted, investigators say
Attackers tried to destroy computer systems at more than 30 Polish wind and solar farms, a large combined heat and power plant and a manufacturing company on Dec. 29, 2025, using custom wiper malware, according to Poland's national computer emergency team and security researchers. Polish officials said the attacks were prepared by groups linked to Russian intelligence.
The incident is one of the most serious attempts to sabotage energy infrastructure in a NATO country. Polish authorities said a successful attack could have cut power to about 500,000 people, journalist Kim Zetter reported.
What happened
According to CERT Polska, the attacks came in the morning and afternoon during cold weather and snowstorms before New Year. At the renewable energy sites, the attacker reached the internal networks of grid connection substations and damaged remote terminal units, firmware and system files. The farms lost communication with and remote control from the distribution system operator, but kept producing electricity.
At the heat and power plant, which supplies heat to almost half a million customers, the attacker had been inside for some time, stealing operational data and privileged accounts. When it tried to deploy the wiper, the plant's endpoint detection software blocked it and heat supply was not disrupted. The same malware was used against the manufacturing company the same day. CERT Polska called the attacks purely destructive and noted that they affected both IT systems and industrial devices, which is rare.
Who is behind it
Prime Minister Donald Tusk said Poland defended itself and there was no blackout. Security company ESET, which named the malware DynoWiper, attributed the attack with medium confidence to Sandworm, a unit of Russia's GRU military intelligence. CERT Polska said the infrastructure used overlaps with a different Russia-linked cluster tracked as Berserk Bear, Static Tundra, Ghost Blizzard or Dragonfly.
What to do
Operators of renewable and distributed energy sites should review remote access to substations, segment control networks from IT, keep offline backups of device configurations and confirm that endpoint protection covers recovery servers.
