Poland Energy Survives Attack on Wind, Solar Infrastructure

On Dec. 29–30, 2025, coordinated wiper attacks targeted Poland’s energy sector — more than 30 decentralized energy resources (wind/solar farms), a manufacturing firm, and a CHP plant — destroying data on HMIs, corrupting RTU and firmware, and causing loss of control and visibility. CERT Polska, Dragos, and CISA link the destructive activity to Russia-aligned threat clusters (Electrum/Sandworm/Berserk Bear), note attackers exploited internet-facing edge devices and default credentials, and issue urgent OT security recommendations including firmware verification, password changes, segmentation, and incident response planning.