Poland’s cybersecurity authorities have revealed that a previously unknown cyberattack disrupted systems at a combined heat and power plant during last winter’s cold snap, threatening to leave tens of thousands of people exposed to freezing weather.

The incident occurred on the same day as coordinated cyberattacks struck more than 30 other renewable energy installations and a larger heat plant, as Poland publicly disclosed in January. Those attacks came "very close" to causing a "blackout" for almost 500,000 people, a senior minister said at the time.

The attacks landed during one of the coldest European winters in more than a decade. They were formally attributed in July to Russia’s Federal Security Service, although CERT Polska, the country's computer emergency response team, did not attribute the additional attack in its supplementary report.

That report focuses instead on an attack on a smaller combined heat and power plant supplying heat to about 50,000 residents — an attack that went unrecognized as a cyberattack at the time, according to Marcin Dudek, the head of CERT Polska.

Speaking Saturday at the DEF CON cybersecurity conference in Las Vegas, Dudek said the attack struck during routine maintenance over the Christmas period. The plant’s operators initially blamed a contractor error for the shutdown of the steam turbine and water treatment system, rather than malicious hackers.

The disruption was caught quickly enough that customer heating was never interrupted, and it was reported only for informational purposes. But given the timing with the other attacks, CERT Polska launched a full investigation into the low-priority report.

The analysis, which took more than three months, uncovered what the agency described as the first known use of a private cellular data network as a pathway into an industrial control system.

"This case demonstrates the importance of reporting not only confirmed incidents but also unexplained failures and operational disruptions," the report said — sharply contrasting with the more limited reporting requirements set out by the European Union’s NIS2 law.

Wind farms and other distributed energy sites communicate with grid operators through private cellular networks; dedicated mobile data connections the industry treats as secure, walled-off infrastructure.

In the newly disclosed incident, the attackers moved from firewalls already compromised at wind farm substations to reach a cellular router connected to one of these private networks, and then used this router to hop across to a controller at the heat plant that was still running factory-default login credentials.

From there the hackers tunneled into the plant’s industrial control systems. The entire chain — wind farm to cellular network to heat plant — saw the hackers move across facilities with no direct relationship to one another besides their shared presence on the same private network.

Once inside, the attackers spent 11 days conducting reconnaissance before striking. They probed industrial equipment, tested credentials against the plant’s firewall and connected to controllers on Christmas Day to map their targets.

Before dawn on December 29, they disabled the Siemens controllers running the steam turbine and water treatment system and locked operators out of those controllers with new passwords.

The hackers then wiped the configurations of network equipment using automated scripts and set device addresses to unreachable values to slow recovery. Plant staff began restoring systems roughly two hours later — while the attackers were still active — and limited the disruption to a brief outage.

The attackers went on to destroy forensic evidence along their entire path, corrupting the device they had used as a gateway into the plant so thoroughly it could not be repaired, and resetting the firewalls and routers behind them.

Investigators were only able to reconstruct the attack because one router ran older software that preserved its event logs through a factory reset.

CERT Polska warned that the misconfiguration that made the attack possible, allowing any device on a private cellular network to communicate freely with any other, was common across Poland at the time and is believed to be widespread internationally.

The agency is urging energy operators to stop treating private cellular networks as trusted infrastructure and to apply the same controls they would use for any internet-facing connections. It called for immediate audits of network configurations, the removal of default passwords from connected devices and the inclusion of these networks in security testing programs.