Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
- ID
- 12994
- Status
- summarized
- Published
- 11 Aug 2026, 2:55 PM
- Fetched
- 11 Aug 2026, 4:09 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/hackers-breach-polish-power-plant.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 11 Aug 2026, 4:12 PM
- Tags
- Audience
- developers
What happened
Attackers shut down a steam turbine and water treatment system at a Polish CHP plant by pivoting through a private cellular APN from a compromised wind farm to a WAGO controller with default admin credentials. CERT Polska, disclosing the December 2025 incident on August 8, called it the first real-world observed use of a private APN as an attack vector into industrial control networks. No CVE was identified and no single patch exists; the root causes were permissive client-to-client APN traffic, default credentials, and exposed management interfaces.
Why it matters
If you build or manage anything behind a private APN or cellular IoT network, audit whether client isolation is enabled and whether devices can reach each other laterally—CERT found this misconfiguration is common across countries. The incident also reinforces that default credentials on reachable controllers remain a live attack path, but there is no specific software patch to apply here.
Discussion angle
The attack vector isn't a zero-day—it's a network design choice (allowing arbitrary client-to-client traffic on a private APN) combined with default credentials, which raises the question of how many IoT deployments in Southeast Asia replicate the same permissive configuration.