Poland uncovers second heat plant cyberattack that went hidden for months

Poland’s CERT Polska uncovered a cyberattack targeting a combined heat and power plant that went undetected for months, highlighting a previously unknown attack vector involving private cellular networks. The attack, occurring alongside other coordinated attacks on renewable energy facilities, exploited misconfigured networks and factory-default credentials to gain access to industrial control systems, causing a brief outage and extensive damage to forensic evidence. CERT Polska is urging energy operators to reassess their security posture regarding these networks.