Allied Intelligence — 2026-05-08

Polish Intelligence Warns Hackers Attacked Water Treatment Control Systems

Poland's Internal Security Agency (ABW) reported on May 6 that attackers breached water treatment facilities in five towns in 2025, naming Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo as affected locations. In some cases the attackers reached industrial control systems and gained the ability to alter device parameters; the ABW said this created a direct risk to water supply continuity. The ABW did not attribute the intrusions to a specific actor but stated Poland faced intensified hostile cyber activity in 2024 and 2025, with particular emphasis on Russian Federation special services. The Record cited Polish cybersecurity outlet CyberDefence24 as having linked several of the incidents to a pro-Russian hacktivist group that posted propaganda videos online; at one facility the group altered pump and alarm settings after compromising an administrator account.

Analysis
At least one pro-Russian hacktivist group crossed from network penetration to active ICS manipulation, altering pump and alarm parameters after compromising an administrator account and establishing a credential-based playbook applicable to any water utility with exposed OT systems. Geographic dispersal across multiple voivodeships argues against opportunism, pointing toward deliberate stress-testing of sector-wide defenses. Analogous intrusions against Polish and neighboring NATO-member water and energy infrastructure are likely to continue through end of 2026, sustained by proven access capability and the low technical bar of credential-based OT compromise. The activity may be autonomous hacktivist opportunism that Moscow-aligned services amplify for propaganda value rather than formally direct, with ICS manipulation specifics resting on The Record's secondary reporting rather than ABW's primary disclosure.

2 sources

Polish intelligence warns hackers attacked water treatment control systems - The Record
Agencja Bezpieczeństwa Wewnętrznego 2024-2025. Wybrane aktywności (Internal Security Agency 2024-2025. Selected Activities) - Agencja Bezpieczeństwa Wewnętrznego (Polish Internal Security Agency)