Hackers Pivot Through Private APN to Sabotage Siemens PLCs at Polish Power Plant

Gbhackers •Mayura Kathir • August 11, 2026

Threat actors used a private cellular access-point-name (APN) network to pivot from a compromised wind farm into the operational technology environment. A Polish combined heat and power plant, where they disrupted Siemens programmable logic controllers and briefly interrupted cogeneration operations. The December 29, 2025 intrusion affected a CHP facility serving approximately 50,000 residents, forcing a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cyberattack on Polish Energy Sector Exploits Private APN Vulnerability In December 2025, hackers breached a Polish combined heat and power (CHP) plant using a private Access Point Name (APN) to access the operational technology network. The attack, attributed to the Russian Electrum threat group, resulted in the shutdown of a steam turbine and water treatment system, affecting a facility that serves 50,000 residents. The attackers initially compromised a FortiGate VPN/firewall at a wind farm and exploited a misconfiguration that allowed devices within the private APN to communicate. They accessed the plant's PLCs and SCADA systems, disrupting operations but causing no significant impact on energy distribution. The Polish Computer Emergency Response Team (CERT) confirmed the incident, marking it as the first known case of such an attack vector in the energy sector. Recovery efforts were swift, and the outage was brief. The incident highlights vulnerabilities in network configurations within critical infrastructure. 6 sources 77

Extracted Entities

Platforms (1)

Siemens PLCs