According to Infosecurity Magazine, Polish authorities released details of a 2025 attack targeting a combined heat and power plant in Poland, in which Russian-linked hackers successfully accessed operational technology (OT) systems through an APN (Access Point Name) connection.
This matters because heat and power plants are dual-use critical infrastructure—they supply both thermal energy for district heating and electrical power to civilian populations. OT access is the operational layer that controls physical processes: turbines, pressure systems, fuel flows, and distribution networks. An APN compromise suggests attackers moved from the IT (information technology) perimeter into production control systems, bypassing or exploiting the boundary that is supposed to isolate OT from external networks.
The timing is significant: this was a 2025 incident, now being formally disclosed in 2026. The lag between discovery and public disclosure suggests Polish CERT conducted a full incident investigation before releasing technical details—standard practice, but it also indicates the attack was serious enough to warrant formal national-level review.
What makes this notable for preparedness planning is the access vector: APN is a mobile network configuration standard. This suggests attackers either compromised a device connected via cellular backhaul, or exploited a mobile-connected gateway that was supposed to be isolated. Many critical plants rely on cellular links for SCADA telemetry, especially in Eastern European regions with older or distributed network topologies. If this plant's APN was exposed to compromise, similar plants across the region may face comparable risk.
The Russian-linked attribution (per Infosecurity) positions this within a pattern of persistent scanning and probing of European infrastructure, though Infosecurity does not specify the assessment basis or confidence level.
WHAT TO WATCH: Subsequent disclosures from Polish CERT or EU critical infrastructure agencies detailing whether this was an isolated intrusion or part of a broader campaign. Any additional alerts about APN-based access to OT systems in similar facilities would indicate systematic rather than opportunistic targeting.
