Cyber & Technology — 2026-05-08

Poland Discloses Hacker Breaches at Five Water Treatment Plants Targeting Industrial Control Systems

Poland's Internal Security Agency (ABW) disclosed Friday that attackers breached water treatment stations in five municipalities during 2025: Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo. In some cases the attackers gained access to industrial control systems and obtained the ability to modify equipment operational parameters, which ABW said created a direct risk to water supply continuity. The agency identified weak password policies and internet-exposed systems as the primary attack vectors enabling the intrusions. ABW did not attribute the water facility breaches to a specific actor, though the report named APT28, APT29, and Belarusian-linked UNC1151 as conducting broader operations against Polish targets and cited intensified Russian intelligence activity against the country.

Analysis
ABW's deliberate non-attribution of the water breaches, even while naming APT28, APT29, and UNC1151 for concurrent Polish operations, signals insufficient forensic confidence to link these intrusions to a state actor, not exculpatory evidence. The documented vectors, internet-exposed control systems and weak password policies, replicate conditions prevalent across NATO water and energy infrastructure. The breaches may instead reflect opportunistic credential exploitation by financially motivated actors rather than state-directed targeting, with ABW's APT citations forensically separate from the water facility intrusions. Corroborated across four outlets but tracing to a single ABW disclosure, at least one additional NATO member will likely publicly disclose a comparable ICS intrusion within the next 90 days. Poland's announcement creates pressure for allied agencies to surface analogous incidents.

4 sources

Poland says hackers breached water treatment plants, and the U.S. is facing the same threat - TechCrunch
Polish intelligence warns hackers attacked water treatment control systems - The Record (Recorded Future News)
Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants - SecurityWeek
Polish Security Agency Discloses Cyber Attacks on 5 Water Treatment Facilities - News4Hackers