No malware, no zero-days: the Polish CHP breach ran on connections nobody drew
On 29 December 2025, attackers switched the Siemens PLCs of a Polish combined heat and power plant into STOP mode and locked them with a password. CERT Polska's report on the incident reads less like an exploit chain than an inventory of connections that existed in production but never on a drawing.
CERT Polska published its follow-up report on 8 August 2026, after an investigation of more than three months. The facts are quickly told. The plant supplies heat to roughly 50,000 residents. The destructive phase ran from about 5:30 to about 10:10 in the morning; the operator began recovery around 7:30, while the intruders were still active on the network, and customers lost neither heat nor electricity. What makes the report worth an OT lead's time is not the impact. It is the route.
The chain, hop by hop
The entry point was not the plant. It was a wind farm belonging to the same operator, where one FortiGate device served as both firewall and VPN concentrator. The VPN was exposed to the internet and allowed accounts without multi-factor authentication. From there the attacker gained administrative privileges and extracted credentials that opened every segment of the wind farm's network.
The pivot is what earned this incident a field note. The operator runs a private APN: a dedicated cellular network that connects its distributed sites. The APN was configured so that any device on it could reach any other device. That single setting turned a transport service into a bridge between facilities, and CERT Polska writes that, to the best of its knowledge, this is "the first instance of this attack vector being observed in a real-world cyberattack".
The rest of the chain needed no invention. An SSH tunnel through a Teltonika RUTX50 cellular router reached the APN. A scan found a WAGO PFC200 controller exposing its web administration interface with default admin credentials. The web interface allowed SSH to be switched on, the controller became the next tunnel, and the attacker was inside the plant's OT network running reconnaissance against the Siemens PLCs over S7. Four days later they were connecting successfully. Four days after that, they turned everything off.
Nothing in this chain is an exploit. Every hop is a configuration doing exactly what it was set to do.
A conduit is a conduit, whether or not it is drawn
None of the destructive actions required malware, and the report describes none. The PLCs were stopped with a supported engineering function. The Moxa servers and switches were reset with their own management features. The tunnels ran over SSH, the reconnaissance over S7. Strip the intent away and the traffic looks like maintenance.
That is why the APN detail matters more than the wiped devices. A private APN feels like plumbing: it is bought as connectivity, managed as a subscription, and it appears on network drawings as a cloud, if it appears at all. In practice it is a conduit between zones, with a threat surface and requirements of its own. CERT Polska notes that Polish organisations commonly leave client-to-client traffic open on private APNs, and expects the same configuration to be widely deployed in other countries. The wind farm and the plant were separate facilities on paper. Through that one setting, they were a single trust domain in practice.
We wrote earlier about temporary and vendor paths that never make it onto the zone drawing. This incident is that mistake at operator scale: the connection that carried the attack was not a forgotten commissioning router but the operator's own wide-area network, trusted precisely because it was private.
What an IEC 62443-3-2 assessment would have asked
Run this incident through the ZCR steps of IEC 62443-3-2 and the chain gets caught early, and more than once.
ZCR 1 fixes the System under Consideration, including every access path into it. A VPN concentrator that reaches OT, a cellular router, a private APN: all of them are in scope, however mundane they look as line items. The question ZCR 1 forces is simply "what can reach this system", and the honest answer here included an internet-facing VPN and a carrier network shared with another facility.
ZCR 3 partitions the SuC into zones and conduits. The wind farm and the plant belong in different zones with their own target security levels; the APN between them is a conduit, and client isolation is a conduit requirement you can write down, assign an owner to, and verify. A conduit that exists in the model cannot silently allow any-to-any.
ZCR 5 sets target security levels against a stated attacker. Measured against the IEC 62443 threat scale, this attacker used generic skills, public tooling and default passwords: squarely the profile that SL 2 is meant to withstand. The countermeasures live in IEC 62443-3-3: SR 1.1 RE 2 asks for multi-factor authentication on untrusted networks, SR 1.5 covers authenticator management, which is where a default admin password fails, and SR 5.1 asks for network segmentation. A plant that heats 50,000 homes and can be reached from a wind farm should not be an SL 1 story.
Four checks worth running this week
CERT Polska closes its report with recommendations. Translated to a working list:
- List your private APNs and ask, for each, whether client isolation is enforced. If nobody can answer, treat that as the answer. Treat the APN as untrusted from the OT side either way.
- Inventory every VPN account that can reach OT, and flag the ones without multi-factor authentication. SR 1.1 RE 2 is the requirement to cite when someone asks why.
- Sweep the address space your OT can be reached from for default credentials. In this incident both the cellular router and the WAGO controller still had them.
- For every management interface reachable from a wide-area network, ask whether it needs to be reachable at all. Remove the exposure; do not just change the password on it.
Could this chain run here?
None of the four checks needs a platform, and this incident needed no exploit. What a platform changes is whether the answers survive the quarter. In OTRISK the APN is a conduit in the model, with a target security level, requirements and an owner. A VPN account without multi-factor authentication reads as an open requirement with a name next to it, not a note in a spreadsheet. And when the next CERT report lands, "could this chain run here" is a question you answer by reading the model, not by re-interviewing the plant. That is what the risk assessment module is for: ZCR 1 through ZCR 7 as the standard defines them, on your own installation.
Sources: CERT Polska, incident follow-up report, energy sector (8 August 2026) · The Hacker News coverage (August 2026). Facts checked 12 August 2026. The SR references are to IEC 62443-3-3; access the standard through your own licensed copy for the exact requirement text.
ISA-certified IEC 62443 trainer and subject-matter expert; CISSP and CISM. Member of NEC 65 and IEC TC65 WG10, the committees where IEC 62443 is written, after 25+ years in software architecture and OT security.
Keep reading
Five zone-partitioning mistakes we keep seeing.
The paths nobody draws are mistake number three. What IEC 62443-3-2 asks of zones, conduits and the lines between them.
Read the field note → RegulationsThe Cyberbeveiligingswet countdown.
Cbw and Wwke take effect on 15 August 2026. The three duties, who is accountable, and what to have ready.
Read the field note →From standard to signed-off.
Bring one installation in mind. In thirty minutes we show you which parts of OTRISK fit your situation and how the way of working looks. You leave with concrete next steps and pricing.
Thirty minutes with an OT security expert, no slideware, no SDR relay.