Attack on Polish Power Grid Targeted IT Systems and Industrial Devices

An attack on the Polish power grid beginning on 29 December 2025 and continuing into the following day is reported to have targeted IT devices and physical industrial devices together.

The steel producer at 25-0505 halted production as a precaution because it could not establish whether process control had been reached. The utility briefing at 25-0522 concerned presence rather than action. The recurring finding, filed at 26-0729 and 25-0729, is that the IT-and-OT boundary is asserted in architecture diagrams more often than it is demonstrated under investigation.

An incident described as reaching industrial devices is therefore a different category from most of what is here — not an intrusion into the business network of an energy company, but into the layer that operates equipment.

IT compromise produces data loss and administrative disruption. Industrial-device compromise produces physical consequences that cannot be restored from backup: equipment operated outside safe parameters, protection systems disabled, supply interrupted to people who have no alternative.

It is also, on the evidence of this corpus, much harder to achieve. It requires knowledge of a specific installation, not a technique that works anywhere — which is why the pre-positioning files at 25-0522 and 26-0715 describe adversaries acquiring that knowledge years in advance.

Graded medium, and the grade carries weight here. Our sourcing is thin: we have not established what was actually achieved on the industrial devices, whether supply was affected, for how long, or by whom.

Grid incidents attract speculative attribution to state actors on the basis of target alone, and this desk does not name one. An attack on a national grid during a period of regional tension will be read politically whatever the evidence shows, which is a reason for more caution rather than less.