Poland Reveals Second Heat Plant Cyberattack; Attack Exploited Private Cellular Network Into Industrial Controls
The cellular-network pivot exposes a critical gap in how NATO treats industrial control system perimeters. Wind farms and distributed energy sites communicate with grid operators over dedicated mobile connections the industry assumes are isolated — but once a substation is compromised, the cellular router becomes an internal network segment with no air gap to other critical infrastructure on the same private network. The heat plant's factory-default credentials were the final failure, but the real vulnerability is architectural: Europe's renewable transition has created a new attack surface (private cellular networks) that sits between the public internet and industrial controls, and it's neither monitored like the internet nor hardened like traditional air-gapped systems.
CERT Polska's three-month forensic analysis exposed a supply-chain vulnerability in European grid architecture that no NATO ally has systematized defenses against: private cellular networks connecting distributed renewable sites are treated as secure perimeter infrastructure, but a single compromised wind farm substation becomes a bridge to heat plants with no direct operational relationship.
The attackers spent 11 days mapping targets before striking on December 29, which means the dwell time was long enough to detect — but operators missed it because the plant's initial shutdown was misattributed to contractor error during routine maintenance. Poland's NIS2 reporting framework would have buried this as low-priority; CERT Polska only caught it by treating unexplained operational disruptions as security incidents. Watch whether other NATO members' grid operators have conducted similar forensics on their own December 2025 incidents — if they haven't, their cellular-network architecture is still exposed.
Did the attackers achieve access to wind farm substations during the January coordinated campaign, or did they compromise them in a separate, earlier operation? The timeline matters: if the wind farms were hit in January and the heat plant pivot happened months later, that's a persistent foothold.
Fault Lines
Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.