Poland's government disclosed in mid-January 2026 that a cyberattack on December 29–30, 2025 struck two combined heat-and-power plants and systems that manage wind and solar generation. Prime Minister Donald Tusk said the intrusion caused no blackout and no system-wide destabilization, according to the Polish government's statement. The incident has since become a reference point for how grid operators detect, disclose, and report attacks on energy infrastructure, and for how regulators are trying to close gaps that let earlier intrusions go unreported for years. This update covers what investigators found in Poland, what new reporting rules are coming for utilities, and which related claims about grid attacks elsewhere remain unconfirmed.
Table of Contents
- What happened to Poland's power infrastructure
- Who carried out the attack
- New federal reporting requirements for utilities
- The broader pattern behind grid intrusions
- What's still unconfirmed
- Frequently Asked Questions
What happened to Poland's power infrastructure
The December 2025 attack targeted two combined heat-and-power plants and the control systems used to manage wind and solar generation. Poland's Energy Minister Miłosz Motyka described it as "the most powerful attack on the Polish power system in years" and said it was successfully repelled, according to the same government statement.
No blackout followed, and Tusk said the attack did not destabilize the broader system. Motyka also committed Poland to increased 2026 spending on cyber-protection for the grid, a sign that officials view the intrusion as a warning rather than a one-off event.
Who carried out the attack
Researchers at ESET attributed the intrusion to Sandworm, a Russia-aligned threat group, with medium confidence. ESET found that the attackers deployed a wiper malware strain it calls DynoWiper to a shared domain directory around December 29, 2025, according to ESET's research report.
A wiper is malware built to destroy or corrupt data rather than steal it, which is why the deployment raised concern even though no outage followed. ESET's own endpoint detection and response software blocked the malware from executing, and the firm reported no confirmed successful disruption to the targeted systems.
New federal reporting requirements for utilities
In the United States, electric utilities are facing a tighter disclosure timeline once a long-delayed rule takes effect. CISA sent its final CIRCIA rule to the White House Office of Management and Budget for review on October 1, 2026. CIRCIA stands for the Cyber Incident Reporting for Critical Infrastructure Act, and once the rule is effective it will require covered critical-infrastructure entities, including electric utilities, to report cyber incidents to CISA within 72 hours and any ransom payments within 24 hours, according to CyberScoop's reporting.
The rule has slipped repeatedly. It missed its original October 2025 statutory deadline, moved to a May 2026 target, and then to a September 2026 target under the government's Unified Agenda. CISA cited an ongoing DHS shutdown that also forced the agency to postpone public town halls planned for March and April 2026, according to Hunton Andrews Kurth's analysis.
- A utility covered by CIRCIA will need an incident-response plan that can produce a reportable disclosure within 72 hours of discovering an incident.
- Ransom payments carry a tighter 24-hour reporting window once the rule is final.
- The rule is still under OMB review, so utilities do not yet face binding CIRCIA deadlines.
The broader pattern behind grid intrusions
Poland's attack fits a pattern regulators have been tracking for years. Joint advisories from CISA, the NSA, and the FBI found that Volt Typhoon, a China-linked group, maintained undetected access to U.S. energy and other critical-infrastructure networks for up to five years, using "living off the land" techniques that rely on legitimate system tools rather than custom malware, according to CISA's advisory as reported by TechTarget.
That advisory from 2024 remains the governing guidance for utilities in 2026. Cyberattacks are not the most common way power facilities get disrupted. The Electricity Information Sharing and Analysis Center's year-end physical security report counted more than 3,500 physical breaches at North American electric facilities in 2025, up from 2,800 in 2023, with about 3% of those breaches actually disrupting electricity service, according to E-ISAC's data cited by IEEE Spectrum. That split matters for utilities deciding where to put limited security budgets: physical intrusions happen far more often than cyberattacks, even though cyber incidents draw more public attention.
What's still unconfirmed
Not every reported grid attack in 2026 has a confirmed cause. Reports linking cyber activity to Venezuela's early-2026 blackouts remain unverified.
A ThreatCluster summary connects a U.S.-linked operation to the outage, but no government or utility has issued an official attribution, according to that secondary reporting. That gap illustrates a recurring problem in grid-security reporting: a technical claim can circulate widely before any utility or government body confirms it. Readers tracking this story should treat the Venezuela case as an open question rather than an established fact, distinct from the attributed and acknowledged Poland incident.
Frequently Asked Questions
Did the Poland attack cause a blackout?
No. Prime Minister Tusk said the December 2025 attack caused no blackout and did not destabilize the system, according to the Polish government's statement.
Who is blamed for the Poland attack?
ESET attributed it to the Russia-aligned group Sandworm with medium confidence, based on wiper malware found in a shared domain directory, per ESET's research.
Are U.S. utilities already required to report incidents within 72 hours?
Not yet. The CIRCIA rule requiring that timeline is still under White House review as of October 2026 and has missed several earlier deadlines, per CyberScoop.
Is cyberattack the leading cause of power grid disruptions?
No. E-ISAC data shows physical breaches at North American electric facilities far outnumber cyber incidents, though only about 3% of physical breaches disrupt service, per IEEE Spectrum.
You Might Also Like
- Cybersecurity — Water Utility Hack: What Organizations Should Fix Next
- Cybersecurity — SEC Cyber Disclosure Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — Known Exploited Vulnerability for Consumers: Warning Signs and Protective Steps