Poland says late-December cyberattack targeted renewables communications

Poland's power system was the target of what the government described as the largest cyberattack in years in the last days of December 2025, yet the operation failed to disrupt electricity supply, Energy Minister Miłosz Motyka told reporters in Warsaw on Jan. 13, 2026. The announcement raised fresh concerns about vulnerabilities tied to distributed renewable generation and the communications networks that link them to distribution operators.

Motyka said the incident was identified by national cyberdefense units and characterized the scale of the operation in stark terms: "The command of the cyberspace forces has diagnosed in the last days of the year the strongest attack on the energy infrastructure in years." He emphasized that, despite the intensity, the attempt did not succeed in disrupting the country’s power system or its electricity grid.

Officials said the December operation differed from earlier strikes on Poland’s energy sector by focusing on the links between renewable installations and distribution operators rather than on large thermal generating units or high-voltage transmission hardware. That shift highlights an expanding attack surface as wind farms, rooftop solar and other distributed resources proliferate and become more tightly integrated with grid control and market systems.

The government released limited technical detail. Motyka declined to identify a perpetrator and did not disclose the specific remedial recommendations his ministry received following the incident. Authorities also withheld forensic specifics such as malware signatures, initial access vectors or the timeline of defensive actions, leaving open questions about how attackers sought to exploit communications protocols and whether any persistent footholds were discovered.

Poland's announcement comes amid a reported rise in cyber activity against national infrastructure. Government figures show some 170,000 cyber incidents were recorded in the first three quarters of 2025, and Poland's digital affairs minister said Russia's military intelligence "trebled" its resources for actions against Poland last year. Those assessments underline a heightened threat environment since Russia's 2022 invasion of Ukraine, but the energy minister did not link the December operation to a named actor during his briefing.

Security specialists and grid operators have long warned that integrating distributed renewable energy creates both operational benefits and new cybersecurity challenges. Communications links that carry telemetry, dispatch instructions and market signals can become vectors for disruption if they are not properly segmented, authenticated and monitored. The incident in December underscores that risk even when core generation and transmission assets remain protected.

Poland's government faces immediate choices about transparency, disclosure and investment. Public reporting of technical findings would help other operators and international partners harden similar systems, but officials must balance that sharing against the risk of exposing defensive weaknesses. For consumers, the episode is a reminder that the clean energy transition also requires sustained attention to cyber resilience.

With key details still withheld, regulators and industry will be watching for follow-up assessments, mandatory security standards for distributed resources and accelerated funding for grid cybersecurity. The failure of the attack to cause outages provides a measure of short-term reassurance, but officials acknowledge that the evolution of tactics toward distributed-generation communications could complicate defenses going forward.