Reported by 5 outlets

Timeline

1. original reporting

   CERT Polska Confirms Siemens PLC Sabotage at Polish CHP Plant via Private APN

   bleepingcomputer.com · 64d ago · August 11th, 2026

   A follow-up report from CERT Polska confirms hackers used a dedicated mobile gateway and a private Access Point Name (APN) — misconfigured to allow arbitrary devices on the network to communicate — to pivot from a wind farm into the OT network of a Polish combined heat-and-power plant, where they sabotaged Siemens programmable logic controllers and shut down a steam turbine and the process-water treatment system. The December 29, 2025 intrusion hit a facility supplying heat to roughly 50,000 residents and briefly interrupted cogeneration. CERT Polska warns the APN misconfiguration pattern is common in Poland and elsewhere and has published hardening recommendations for private APN deployments.

   ---

2. update from cert.pl

   CERT Polska: Private APN Was the Unseen Vector in December's Poland Energy Attacks

   cert.pl · 66d ago · August 9th, 2026

   A follow-up report on the December 29, 2025 destructive attacks on Poland's energy sector reveals a second combined heat-and-power plant — supplying heat to 50,000 residents — was also hit in parallel, with attackers shutting down a steam turbine and the water-treatment system and interrupting cogeneration. The three-month investigation surfaced a previously unobserved access path: an attacker-operated private APN into the OT network, the first real-world use of that vector, enabled by a misconfiguration that let any device on the APN communicate with the plant. CERT Polska warns the configuration is common in Poland and other countries and published recommendations for private APN-based deployments; the findings were presented at DEF CON.

3. mentioned by securityweek.com

   Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility

   securityweek.com · 64d ago · August 10th, 2026

4. update from bleepingcomputer.com

   Hackers breached a small Polish energy plant via private APN last year

   bleepingcomputer.com · 64d ago · August 10th, 2026

   The Polish Computer Emergency Response Team (CERT) disclosed this second incident in a follow-up report over the weekend, saying that the attacker used a private Access Point Name (APN) to access the operational technology network. "The attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another." On December 29, 2025, an attacker believed to be linked to the Russian Electrum threat group targeted 30 wind and solar power installations and a large CHP plant in Poland, destroying key equipment beyond repair. The threat actor hit distributed energy resource (DER) sites across the country, disabled communications equipment, corrupted operational technology (OT) devices, and wiped Windows systems. Despite this effort to destabilize the grid, energy generation and distribution were not disrupted. In the newly disclosed attack at a second, smaller CHP plant, the threat actor switched off the programmable logic controllers (PLC) and protected access with a password, thus deactivating a steam turbine and the plant’s process-water treat

5. update from cyberpress.org

   Hackers Abuse Private APN to Pivot From Wind Farm Into Polish CHP Plant and Shut Down Turbine

   cyberpress.org · 63d ago · August 11th, 2026

   The private APN allowed connected devices to communicate with each other, creating an unexpected route into another critical energy environment. The attackers first accessed a perimeter device at the wind farm and established a remote VPN connection . They then identified a Teltonika RUTX50 cellular router, accessed its web management interface, and logged in to its SSH service. Recovered logs indicating successful SSH logins to the Teltonika cellular router (Source: cert) Beginning on December 18, 2025, the threat actors scanned the APN for exposed VNC, HTTP, S7, and Modbus services. During this activity, they found a WAGO PFC200 controller connected to the CHP plant. Its WAN-facing web administration interface was reachable from the APN and still used the default credentials for the admin account. The controll

6. update from gbhackers.com

   Hackers Pivot Through Private APN to Sabotage Siemens PLCs at Polish Power Plant

   gbhackers.com · 63d ago · August 11th, 2026

   The December 29, 2025 intrusion affected a CHP facility serving approximately 50,000 residents, forcing a […] The post Hackers Pivot Through Private APN to Sabotage Siemens PLCs at Polish Power Plant appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .