Follow-Up Report of the December 2025 Energy Sector Incident

**Executive summary:** CERT Polska investigated coordinated, destructive cyberattacks on Poland's energy infrastructure on 29 December 2025 that targeted 30 wind and solar installations and multiple combined heat and power (CHP) plants; a follow-up analysis identified a novel attack vector where a misconfigured private APN allowed arbitrary devices on the APN to access OT systems, resulting in the shutdown of a steam turbine and the process water treatment system at a CHP plant serving 50,000 residents, though prompt operator response limited service disruption, and the report concludes with recommendations for organisations using private APN-based solutions.