Cyberattack on Poland's Energy Grid: A Failed Attempt by Russian Hackers

In late December 2025, Poland's energy infrastructure was targeted by a cyberattack involving wiper malware, attributed to Russian state-sponsored hackers. The attack occurred on December 29 and 30, aiming to disrupt communications between renewable energy installations and power distribution operators. However, the attempt did not succeed, and specific reasons for this failure remain undisclosed.

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt ElectricityResearchers say Russian government hackers were behind attempted Poland power outageWiper malware targeted Poland energy grid, but failed to knock out electricity

The malware involved in the attack has been identified as "DynoWiper," a type of wiper malware designed to irreversibly erase data and disrupt operations. Security firm ESET, which analyzed the incident, attributed the malware to the Russian hacker group Sandworm, a unit within Russia's military intelligence agency, GRU. ESET expressed "medium confidence" in this attribution, citing a strong overlap with previous Sandworm activities, including past attacks on Ukraine's energy sector.

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt ElectricityWiper malware targeted Poland energy grid, but failed to knock out electricityResearchers say Russian government hackers were behind attempted Poland power outage

Polish Energy Minister Milosz Motyka characterized the incident as the "strongest attack" on Poland's energy infrastructure in years. Local media reported that the cyberattack could have potentially affected heat and power for at least half a million homes. Despite the severity of the attempted breach, Poland's Prime Minister Donald Tusk stated that the country's cybersecurity defenses were effective, asserting that "at no point was critical infrastructure threatened."

Researchers say Russian government hackers were behind attempted Poland power outage

Sandworm has a notorious reputation for executing destructive cyberattacks on behalf of the Kremlin. A notable incident occurred in December 2015 when a similar attack on Ukraine's power grid resulted in approximately 230,000 people losing electricity for nearly six hours during a cold winter. In that case, the hackers used malware named BlackEnergy to infiltrate power companies' supervisory control and data acquisition systems, allowing them to halt electricity distribution.

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt ElectricityWiper malware targeted Poland energy grid, but failed to knock out electricityResearchers say Russian government hackers were behind attempted Poland power outage

While the Polish government has attributed the attack to Russian hackers, some cybersecurity experts emphasize the need for enhanced international cooperation to address such threats. They argue that ongoing vulnerabilities in critical infrastructure systems necessitate a more robust global response to deter future cyberattacks.

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt Electricity

• “Based on our analysis of the malware and associated TTPs, we attribute the attack to the Russia-aligned Sandworm APT with medium confidence due to a strong overlap with numerous previous Sandworm wiper activity we analyzed,” — ESET Researchers

Wiper malware targeted Poland energy grid, but failed to knock out electricity

• “This incident highlights ongoing cybersecurity threats against critical infrastructures worldwide.” — ESET Analysts

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt Electricity

• “Motyka called the incident the “strongest attack” on Poland’s energy infrastructure in years, with the Polish government blaming Moscow for the attempt.” — Milosz Motyka, Polish Energy Minister

Researchers say Russian government hackers were behind attempted Poland power outage

• “at no point was critical infrastructure threatened.” — Donald Tusk, Prime Minister of Poland

Researchers say Russian government hackers were behind attempted Poland power outage

The attempted cyberattack on Poland's energy grid underscores the persistent threat posed by state-sponsored hacking groups like Sandworm. While the attack did not achieve its objectives, it serves as a reminder of the vulnerabilities within critical infrastructure and the ongoing need for vigilance in cybersecurity measures.

Wiper Malware Targets Poland’s Energy Grid, Fails to Disrupt Electricity