On January 14, 2026, Polish Prime Minister Donald Tusk briefed government leaders on a sophisticated cyberattack that occurred on December 29, 2025. The attack targeted operational technology systems at multiple sites across Poland's electric grid, focusing on distributed energy resources such as wind farms, solar installations, and combined heat and power facilities. The attack exploited common connectivity patterns and repeated vulnerabilities in Remote Terminal Units, network devices, and communications infrastructure managing distributed generation sites. CERT Polska led investigation and response efforts, with involvement from Dragos confirming with moderate confidence that the ELECTRUM threat group, linked to previous attacks on electrical infrastructure and exhibiting overlaps with Sandworm, was responsible. The attack marks the first major coordinated targeting of distributed energy resources at scale, exposing the unique cybersecurity challenges posed by widely dispersed and remotely managed renewable assets. While no coordinated operational impact was achieved, the access gained demonstrates the adversary's capability to compromise operational technology systems at scale, posing a significant risk for future operational disruptions.

On January 14, 2026, Polish Prime Minister Donald Tusk briefed government leaders on a sophisticated cyberattack that occurred on December 29, 2025. The attack targeted operational technology systems at multiple sites across Poland's electric grid, focusing on distributed energy resources such as wind farms, solar installations, and combined heat and power facilities. The attack exploited common connectivity patterns and repeated vulnerabilities in Remote Terminal Units, network devices, and communications infrastructure managing distributed generation sites. CERT Polska led investigation and response efforts, with involvement from Dragos confirming with moderate confidence that the ELECTRUM threat group, linked to previous attacks on electrical infrastructure and exhibiting overlaps with Sandworm, was responsible. The attack marks the first major coordinated targeting of distributed energy resources at scale, exposing the unique cybersecurity challenges posed by widely dispersed and remotely managed renewable assets. While no coordinated operational impact was achieved, the access gained demonstrates the adversary's capability to compromise operational technology systems at scale, posing a significant risk for future operational disruptions.