What happened at the plant
On December 29, 2025, between 5:30 and 10:10 a.m., attackers forced a steam turbine and a process-water treatment system into STOP mode at a combined heat and power plant in Poland serving roughly 50,000 residents. Recovery began around 7:30 a.m., and CERT Polska's investigation, released August 8 after three months of work, confirmed that residents lost neither heat nor electricity during the incident. That outcome owed more to the plant's operational redundancy than to the attackers holding back.
The report, covered by The Hacker News on August 11, describes a methodical intrusion rather than an opportunistic one. The attacker spent eleven days inside the network before taking any destructive action, first scanning a private cellular network starting December 18, then connecting to Siemens programmable logic controllers via the S7 protocol on December 25, apparently for reconnaissance. The destructive phase on December 29 was fast and deliberate: turbine and water treatment systems switched off, then supporting network gear wiped.
The entry point was a wind farm, not the plant itself
The attackers never touched the power plant's perimeter directly. Investigators traced the initial compromise to a separate wind farm facility, where a FortiGate firewall serving as a VPN concentrator had exposed accounts without multi-factor authentication. From there, the attacker obtained administrative privileges and used SSH tunneling to reach a Teltonika RUTX50 cellular router, then pivoted into a private Access Point Name, a dedicated cellular data network the distribution system operator used to connect remote equipment.
CERT Polska called this the first documented real-world use of a private APN as an attack pathway. That distinction matters because private APNs are typically treated as inherently isolated, a cellular carrier's equivalent of an air gap, and get little of the monitoring or segmentation scrutiny applied to VPNs or corporate networks. This incident shows that assumption does not hold when the APN itself allows arbitrary client-to-client communication, which CERT Polska found was a common misconfiguration among Polish organizations using this architecture.
No exploit needed: default credentials and standard protocols did the job
Nothing in this attack chain required a software vulnerability. The WAGO PFC200 controller that served as a pivot point still had its web administration interface reachable with default credentials, a basic hygiene failure rather than a zero-day. Investigators specifically noted that the Teltonika router's SSH service and the WAGO controller's web interface were both working as designed, and could not confirm whether any of the known Teltonika RUT-series CVEs, previously flagged by CISA, were even in play.
Three Siemens controller families were reachable during the reconnaissance phase, the S7-300, S7-1200, and S7-1500 lines, all accessed over the standard S7 communication protocol rather than through any injected exploit code. For a CISO, this is the more uncomfortable finding than a novel vulnerability would have been: the attacker won using misconfiguration and legitimate protocol access, which means patching alone would not have stopped this, and neither would a vulnerability scanner tuned only to look for known CVEs.
The attackers covered their tracks thoroughly
Before leaving, the attacker factory-reset seven Moxa serial device servers and three network switches, wiping their configurations and leaving them with unreachable IP addresses. The WAGO controller's partition table was corrupted specifically to remove its logs, and both the Teltonika router and the FortiGate firewall were factory-reset as well, destroying the event logs investigators would otherwise have used to reconstruct the intrusion timeline in full detail. Investigators had to rebuild much of the sequence from secondary sources, including logs held by the cellular carrier and the distribution system operator, rather than from the compromised devices themselves.
That level of anti-forensic discipline, combined with the eleven-day dwell time before any destructive action, points to an operator who understood the environment well before acting. CERT Polska did not name a specific threat actor, placing the incident within a broader campaign against Polish energy infrastructure in December 2025 that has drawn separate, differing assessments from the Polish government, ESET, and Dragos. The lack of consensus attribution is itself a signal that this kind of OT intrusion is becoming harder to pin down quickly.
What this means for OT security programs
Most OT security programs still organize their monitoring around the corporate network boundary and known-vulnerability scanning of PLCs and RTUs. This incident bypassed both. The real exposure sat in a chain of trust between a wind farm's VPN, a cellular router, and a private APN that nobody treated as part of the attack surface, precisely because none of those components sit inside the traditional IT or OT perimeter that most monitoring tools are built to watch. A vulnerability scanner pointed at the plant's own network would have found nothing wrong, because the plant's own network was never where the weakness lived.
For utilities and any industrial operator running distributed assets over cellular or private wireless links, the practical takeaway is to inventory every private APN and cellular gateway with the same rigor applied to VPN concentrators, including MFA enforcement, default credential audits, and client-to-client traffic restrictions. The plant survived because of physical and operational redundancy, not because the network held. That is not a resilience plan a CISO should want to rely on twice, and boards asking about OT risk this quarter should be asking specifically whether cellular and private-network links to remote sites have ever been included in a penetration test scope.
