Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps | CISA

A cyber incident targeting Poland's energy sector has exposed critical vulnerabilities in operational technology (OT) and industrial control systems (ICS) that manage essential infrastructure. The attack, which occurred in early 2025, disrupted energy distribution networks and raised alarms about the security posture of systems that control power grids, water treatment facilities, and other critical services.

The incident specifically targeted supervisory control and data acquisition (SCADA) systems that monitor and control industrial processes. These systems, which bridge the gap between IT networks and physical infrastructure, often lack the security controls found in traditional enterprise environments. Many OT systems were designed decades ago with operational reliability as the primary concern, not cybersecurity.

According to CISA analysis, the attackers exploited unpatched vulnerabilities in legacy control systems that had not received security updates in years. The compromised systems included programmable logic controllers (PLCs) and human-machine interfaces (HMIs) that directly control power generation and distribution equipment. Once inside the network, the attackers moved laterally to gain control over substation automation systems.

This incident highlights several systemic issues in OT security. First, many critical infrastructure operators continue to run outdated operating systems and firmware that no longer receive vendor support. Second, the convergence of IT and OT networks has expanded the attack surface without corresponding security investments. Third, the shortage of personnel with both cybersecurity and industrial control system expertise creates operational blind spots.

The attack's impact extended beyond immediate service disruptions. Energy providers reported that recovery took several days as they had to manually verify the integrity of control systems before restoring full operations. This manual verification process is necessary because automated recovery tools cannot be trusted when the control systems themselves may have been compromised.

CISA has issued specific recommendations for organizations operating OT and ICS environments. These include implementing network segmentation between IT and OT networks, deploying intrusion detection systems capable of monitoring industrial protocols, and establishing regular backup procedures for control system configurations. The agency also emphasizes the importance of maintaining an accurate inventory of all OT assets, including legacy equipment that may not appear in traditional IT asset management systems.

For immediate mitigation, CISA recommends that energy sector organizations review their incident response plans specifically for OT environments, conduct tabletop exercises that include scenarios involving control system compromises, and establish communication channels with equipment vendors for rapid vulnerability disclosure and patching.

The Poland incident serves as a wake-up call for critical infrastructure operators worldwide. As nation-state actors increasingly target industrial control systems, the gap between IT security maturity and OT security readiness has become a national security concern. Organizations must prioritize securing the systems that keep the lights on, water flowing, and essential services operational.

For more information on securing OT and ICS environments, visit CISA's Industrial Control Systems Cybersecurity page or contact CISA's Cyber Hygiene Services for no-cost vulnerability scanning and assessment.