Russian hackers breached Polish power grid thanks to bad security, report says

In a concerning revelation, the Polish government has confirmed that hackers linked to the Russian government infiltrated sections of the nation’s energy grid, exploiting significant security weaknesses. A detailed report from Poland’s Computer Emergency Response Team (CERT), a division of the Ministry of Digital Affairs, was published on Friday, shedding light on an incident that occurred late last year. The report indicates that the hackers compromised various energy facilities, including wind and solar farms as well as a heat-and-power plant. Alarmingly, the attackers faced minimal resistance due to the use of default usernames and passwords and a lack of multi-factor authentication—fundamental cybersecurity oversights. The intruders attempted to deploy wiper malware aimed at erasing data and potentially crippling operations, although the ultimate goal remains uncertain. Thankfully, while the attack was thwarted at the heat-and-power plant, the malware did render the monitoring and control systems of the wind and solar farms inoperable. The report described the nature of the attacks as purely destructive, likening them to acts of arson in the physical realm. Despite the penetration, the hackers did not manage to disrupt power at any of their targeted sites. Additionally, the report reassures that even if they had succeeded, the overall stability of the Polish power grid would not have been compromised during the incident. Earlier reports from cybersecurity firms ESET and Dragos pointed fingers at the notorious Sandworm group, known for its history of targeting energy systems in Ukraine. However, Poland’s CERT has attributed the breaches to a different Russian hacking group known as Berserk Bear or Dragonfly, which is typically associated with cyberespionage rather than destructive hacking.