The cyberattack against a small Polish combined heat-and-power plant provides an important warning for operators of industrial networks that depend on private cellular connectivity. Attackers did not reach the plant by directly exposing its controllers to the public internet. Instead, they compromised infrastructure belonging to another energy facility, moved through a private Access Point Name used for cellular communication and eventually reached industrial controllers inside the CHP plant. The incident demonstrates that a private APN can reduce internet exposure, but it does not automatically provide isolation, authentication or protection against lateral movement. Once one connected organization or device becomes compromised, a poorly segmented private network can effectively become an internal highway connecting otherwise independent industrial facilities. 

The attack occurred on December 29, 2025 and affected a CHP plant supplying heat to approximately 50,000 residents. Attackers ultimately switched several Siemens PLCs into STOP mode and protected them with passwords, causing the steam turbine and process-water treatment system to shut down and interrupting the cogeneration process. Plant personnel reacted quickly, restored affected controllers from backups and returned operations to service before customers experienced disruption to heat or electricity. The limited public impact should not obscure the seriousness of the attack: an external adversary successfully manipulated industrial controllers responsible for physical energy-production processes.

The most significant aspect of the incident is the attack route. CERT Polska determined that the attacker initially obtained access to a FortiGate device operating as both the firewall and VPN concentrator at a separate wind farm. The VPN interface was accessible from the internet and accounts stored on the device could authenticate without multi-factor authentication. Investigators concluded that administrative privileges on the FortiGate likely enabled the attackers to obtain VPN credentials providing broad access to network segments inside the wind farm.

Inside that environment, the attackers discovered a Teltonika RUTX50 cellular router connected to the private APN operated by the Distribution System Operator. The cellular router existed to provide communication between energy infrastructure and the operator's systems, but one of its Ethernet interfaces was also connected to a network segment reachable through the compromised firewall. This created an unexpected bridge between an internet-accessible corporate or operational environment and the supposedly private cellular network.

The attacker subsequently logged into the Teltonika router through SSH and appears to have established a tunnel into the private APN. Investigators could not determine conclusively how the attacker obtained the router's changed administrator password or whether another vulnerability was involved, so the incident should not be simplified into a claim that the Teltonika device itself was exploited through a known vulnerability. What matters architecturally is that control of the router provided access to a network that multiple industrial installations assumed was private.

Beginning on December 18, the attackers scanned the private APN for VNC, HTTP, Siemens S7 and Modbus services. The ability to perform this reconnaissance was possible because devices connected through the APN were not adequately isolated from one another. A network intended primarily to transport telemetry and industrial communications therefore allowed a compromised participant to discover and communicate with other connected facilities.

This is where the incident challenges a widely held assumption about private APNs. Organizations sometimes treat cellular private networks almost like physically isolated infrastructure because their addressing is not directly reachable from the public internet. That assumption is unsafe. A private APN is ultimately a shared communications environment whose security depends on routing, client isolation, authentication and access-control policies. If one participant can communicate freely with every other participant, compromise of any connected device can become compromise of the trust model for the entire network.

The attackers eventually discovered a WAGO PFC200 controller belonging to the CHP plant. Its web administration interface was reachable through the APN and, critically, the administrator account still used default credentials. The attacker logged into the controller, enabled SSH on its WAN interface and then used another SSH tunnel through the controller to reach the CHP plant's internal OT network.

This sequence illustrates how several individually familiar weaknesses can combine into a far more serious industrial intrusion. Internet-accessible remote access without MFA, administrative control of a firewall, a cellular router bridging different trust zones, a private APN without sufficient client isolation, an industrial controller exposing an administrative interface and unchanged default credentials collectively created an attack path across two separate energy facilities. No single defensive control failed in isolation; the architecture allowed one compromise to cascade through several assumed trust boundaries.

After entering the CHP network, the attackers did not immediately disrupt operations. They spent approximately a week conducting reconnaissance, scanning industrial protocols and remote-access services and identifying valuable systems. Network activity showed probes for Siemens S7, Modbus, CODESYS, RDP, VNC, HTTP and HTTPS services. On December 25, the attackers successfully communicated with three Siemens PLCs, likely preparing for the destructive operation that followed four days later.

This dwell period is an important defensive opportunity. Industrial attacks capable of manipulating physical processes frequently require reconnaissance because adversaries must understand the environment sufficiently to know which controllers and processes they are changing. OT monitoring should therefore focus not only on malware but also on unusual industrial-protocol activity, scanning and communication patterns. A controller that suddenly begins probing numerous devices or initiating S7 connections to systems it has never contacted before should generate investigation even if no traditional malware signature is present.

On December 29, the attackers connected to the SCADA interface and three Siemens controllers, including S7-300, S7-1200 and S7-1500 PLCs. Plant personnel reported that the PLCs were switched into STOP mode and protected with passwords that prevented operators from easily changing their operating state or modifying the control logic. This directly affected the steam turbine and the process-water treatment system and temporarily stopped cogeneration.

This is a significant distinction from many cyberattacks described as attacks on critical infrastructure. The adversary did not merely encrypt an office workstation or interrupt an administrative application associated with an energy company. They issued actions against industrial controllers that produced a physical operational consequence. The attack therefore belongs firmly in the category of OT cyber sabotage.

The attackers also targeted supporting industrial infrastructure. Seven Moxa serial-device servers and three Moxa network switches were reset to factory settings, had administrator passwords changed and were assigned unusable IP addresses such as 127.0.0.1. These actions appear designed not only to interrupt operations but also to make recovery more difficult. Investigators concluded with high confidence that at least some of these changes were automated.

This recovery-denial behaviour deserves particular attention. Attackers targeting OT environments understand that operators may be able to recover primary controllers rapidly if good backups exist. Destroying communication equipment, altering addressing and changing passwords forces engineers to troubleshoot multiple infrastructure layers simultaneously and can extend the duration of physical disruption. Cyber resilience therefore requires configuration backups for switches, gateways, serial converters and routers as well as PLC logic.

Fortunately, the CHP plant had backups of its controller programs and operators were able to factory-reset affected PLCs and reload their logic. That significantly shortened the outage. The incident provides a practical demonstration of why offline and tested backups of PLC programs, HMI configuration, SCADA systems and network-device configuration are essential. Industrial organizations should be able to rebuild a controller without relying on the compromised engineering workstation or affected management network.

There was also an unfortunate forensic trade-off. Resetting the PLCs enabled rapid operational recovery but deleted local controller logs, making subsequent investigation more difficult. Industrial incident-response plans should therefore establish procedures for capturing volatile or device-level forensic evidence where this can be performed without delaying safety-critical restoration. Operations will correctly take priority during a real physical disruption, but having predefined evidence-collection procedures can reduce the amount of information lost during emergency recovery.

The attacker also attempted to destroy evidence deliberately. The WAGO controller used as the bridge into the CHP network had its partition table corrupted, leaving the device unable to boot and preventing investigators from recovering useful data even after laboratory examination. The Teltonika router was later reset, its password changed and its address made unreachable, while the FortiGate device used during the initial intrusion was factory-reset as one of the final observed attacker actions. These steps demonstrate that the adversary understood both the infrastructure and the value of deleting forensic evidence.

The attack reinforces why industrial networks should not depend upon obscurity. CERT Polska specifically investigated whether the WAGO controller had accidentally been exposed directly to the Polish internet and determined that it had not. The controller was effectively hidden from ordinary internet scanning, yet attackers still found it by first compromising another organization and entering through the shared APN. A device being invisible to Shodan or other public scanners therefore does not prove it is securely isolated.

Operators using private APNs should treat the network as untrusted transport rather than as an extension of the OT LAN. Communications from the APN should terminate at controlled gateways where strict allowlists determine which devices and industrial protocols are permitted. A remote telemetry device that needs to exchange DNP3 data with one DSO endpoint should not automatically receive IP connectivity to unrelated controllers, management interfaces or other facilities.

Client isolation should be enabled so one subscriber cannot discover or communicate directly with another subscriber unless that communication is explicitly required. The Polish investigation found that the relevant APN configuration allowed arbitrary devices inside the private network to communicate with one another, which enabled the lateral movement between facilities. Network providers and utilities should validate isolation technically rather than assuming the word “private” in the service description provides it automatically.

Administrative interfaces on industrial devices should also be separated from telemetry interfaces. In this incident, the WAGO controller exposed its web management interface through the APN even though the network existed primarily to support operational communications. Management interfaces should be reachable only from dedicated engineering networks or secured jump hosts, and industrial protocols should be limited to explicitly required peers.

Default credentials should be eliminated before any industrial device is connected to an operational network. The WAGO PFC200 provided the critical bridge into the CHP plant because its `admin` account retained the default password. Changing default credentials is an elementary security control, yet legacy industrial environments continue to contain devices installed under assumptions that private networks made strong authentication unnecessary.

SSH, Telnet and web administration should similarly be disabled on interfaces where they are not operationally required. CERT Polska recommends disabling unnecessary remote administration services and strictly controlling communication between APN gateways and OT infrastructure. Every listening service provides another opportunity for an attacker who eventually enters the network.

The initial wind-farm compromise also reinforces the importance of protecting edge devices. The FortiGate VPN interface was internet-accessible and authentication did not require MFA. Regardless of the precise means through which the attacker first obtained privileged access, remote-access infrastructure protecting industrial networks should use phishing-resistant MFA wherever possible and should restrict administrative access to dedicated management paths.

Segmentation inside the plant must assume that perimeter controls may eventually fail. The WAGO controller connected through the APN should not have automatically become a bridge capable of reaching SCADA systems and critical industrial controllers. Firewall policy between communications infrastructure and control networks should permit only specifically required protocol flows between defined endpoints.

Industrial environments should also deploy passive OT network monitoring capable of recognizing unusual protocol use without interfering with sensitive equipment. The week of reconnaissance preceding this attack produced activity involving S7, Modbus, CODESYS and multiple remote-management protocols. Such behaviour is unusual enough that a properly baselined monitoring system could potentially identify it before destructive actions begin.

The timing of the reconnaissance also illustrates why monitoring must operate continuously. Significant scanning occurred on December 21, a Sunday, and connections to Siemens PLCs occurred on Christmas Day. Attackers deliberately benefit from periods when fewer engineers and security personnel are watching networks. Critical infrastructure monitoring cannot become effectively blind outside ordinary office hours.

Another important lesson concerns shared infrastructure between different operators. A security weakness at one wind farm eventually became an access path toward a completely separate CHP plant because both participated in the same DSO-managed communication environment. Utilities and telecommunications providers therefore need to threat-model what happens when one customer endpoint is fully compromised rather than assuming every participant remains trustworthy.

This is similar to segmentation requirements in multi-tenant cloud environments. One customer should never be able to scan or interact with another simply because both use infrastructure operated by the same provider. Industrial APN networks should enforce comparable tenant isolation and restrict routing according to exact operational relationships.

The incident also demonstrates why supply-chain and contractor requirements need to include secure configuration. Cellular routers, PLCs and remote telemetry systems are frequently installed by specialized integration companies, and operational organizations may inherit whichever configuration the installer considered convenient. Asset owners should verify management exposure, passwords, network interfaces and remote-access settings independently before equipment becomes operational.

Security requirements issued by DSOs should specify more than the industrial communication protocol. CERT Polska noted that requirements existed for DNP3 communication between the DSO and RTU, but requirements had not been defined for handling the cellular router's administrative interface. Security architecture fails when specifications describe what legitimate communication must work but do not define what communication must be impossible.

The fact that heat and electricity supplies were not interrupted should not minimize the incident. Operators prevented a more serious consequence through rapid recovery, but the attackers achieved direct manipulation of industrial control systems and temporarily shut down important plant processes. The same attack occurring during different operating conditions, against a less prepared facility or with additional destructive steps could have produced significantly greater consequences.

Poland's broader December 29 campaign already demonstrated coordinated destructive activity against more than 30 wind and photovoltaic facilities and a large combined heat-and-power plant. CERT Polska assessed the overall activity as destructive rather than financially motivated, and the broader campaign caused damage to industrial devices and communication systems even though national electricity production remained stable. The newly analysed second CHP incident adds an important technical dimension by showing how a shared private cellular network became part of the attack path.

The strategic lesson is straightforward: connectivity that bypasses the public internet is not equivalent to trusted connectivity. Private APNs, MPLS networks, leased lines and dedicated telecommunications services can reduce exposure, but they still require authentication, segmentation, filtering and monitoring. If attackers compromise any participant capable of reaching those networks, the supposedly private transport may become their route into other systems.

Industrial organizations should therefore inventory every cellular modem, private APN connection and remote telemetry gateway connected to their facilities. They should document what devices are reachable through each connection, verify client isolation with the telecommunications provider, remove default credentials, disable unnecessary management services and implement firewall allowlists permitting only the exact operational traffic required.

Private network providers and DSOs should likewise perform active validation rather than relying solely on configuration records. Testing from one subscriber endpoint should confirm that unrelated customers and facilities cannot be reached. If cross-client scanning is technically possible, the APN should be considered a shared hostile network until the architecture is corrected.

The Polish incident provides a useful security principle for all OT operators: trust should be assigned to authenticated devices and explicitly permitted communications, not to a network because somebody labelled it private.

The attackers ultimately moved from an internet-facing device at one energy facility, through a cellular router, across a private APN, into a PLC at another facility and from there into a completely separate industrial control network. Every transition crossed a boundary that somebody could reasonably have assumed would stop an external attacker.

None of those boundaries did.

That is why the most important lesson from this incident is not simply to secure cellular routers or change PLC passwords. Industrial security architecture must assume that every intermediate communications network can eventually be reached by an attacker and ensure that compromise of one participant cannot become authorization to communicate with every other participant.

A private APN should make an industrial system less exposed. It should never be the reason the system is trusted.

Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. [...]

Source: Hackers breached a small Polish energy plant via private APN last year via Bleeping Computer — published 10 Aug 2026.