Imagine a world where the very systems that keep your lights on and your home warm are vulnerable to a hacker’s keyboard. This isn’t science fiction—it’s the reality faced by Poland’s energy sector in late 2025. A steam turbine and water treatment system at a combined heat and power plant were shut down remotely, not by a virus or malware, but by exploiting a configuration flaw in a private cellular network. What makes this incident particularly fascinating isn’t just the technical exploit, but the glaring human oversight that made it possible. Let’s unpack why this should terrify anyone who relies on critical infrastructure.
The attack didn’t start with a zero-day vulnerability or a sophisticated ransomware strain. Instead, it began with something far more mundane: default admin credentials. The WAGO controller at the plant had its password set to factory defaults, a practice so common in industrial environments that it’s almost a cultural norm. In my opinion, this is a systemic failure of security awareness. We’ve all heard the mantra ‘change default passwords,’ yet here we are, watching it happen again. What many people don’t realize is that in the rush to deploy systems quickly, security often takes a backseat to convenience. This isn’t just about negligence—it’s about a deeper misunderstanding of what ‘security’ actually means in the real world.
The private APN (Access Point Name) used by the grid operator was supposed to be a secure, isolated network. Instead, it became a digital highway for attackers. The configuration allowed any device on the network to communicate with any other, creating a perfect storm of vulnerability. From my perspective, this is the most alarming part of the story. It’s not just a technical misstep; it’s a fundamental failure of network design principles. When I think about how many organizations still use similar configurations, it’s clear that we’re operating under the illusion of security. A detail that I find especially interesting is that the APN wasn’t even managed by the plant itself—it was run by the distribution system operator. This raises a deeper question: Who’s actually responsible for securing these networks? The answer, apparently, is no one.
The attack path was as methodical as it was terrifying. Starting at a wind farm, the hackers exploited a FortiGate firewall with no multi-factor authentication, gaining administrative access. From there, they pivoted through the APN to the CHP plant, using SSH tunneling to bypass defenses. What this really suggests is that the entire system was designed with the assumption that the network was safe, not that it needed to be secure. The router’s SSH service, the controller’s web interface, and the permissive APN were all working as configured—because no one thought to question that configuration. This isn’t just a technical problem; it’s a psychological one. Organizations have become so reliant on the idea that ‘if it’s not broken, it doesn’t need fixing’ that they ignore the quiet ticking of the time bomb.
The aftermath was equally telling. The attacker didn’t just shut down systems—they wiped logs, reset devices, and left behind no trace of their presence. The WAGO controller’s partition table was corrupted, and the Teltonika router was factory-reset with an unreachable IP address. This level of cleanup suggests a level of sophistication, but also a chilling realization: the attack didn’t require advanced tools. It required knowing the system’s weaknesses—and exploiting them in plain sight. If you take a step back and think about it, this is a blueprint for future attacks. Every component in the network had a known vulnerability, and none of them were addressed. The timing of the attack, coinciding with maintenance work, further highlights how easily human error can be weaponized.
The broader implications are staggering. CERT Polska’s report reveals that similar APN configurations are likely widespread, not just in Poland but globally. This isn’t an isolated incident—it’s a wake-up call. The fact that the FBI and EPA still recommend private APNs as an isolation option underscores a dangerous disconnect between policy and reality. We’re being told to trust these networks, yet here we are with a real-world example of how they can be weaponized. What this really suggests is that our approach to securing critical infrastructure is decades behind the threats we face. The reliance on legacy systems, the lack of accountability for network configurations, and the cultural inertia around change all contribute to a crisis that’s only going to get worse.
As we move forward, the question isn’t just how to patch this particular vulnerability. It’s how to rebuild our entire mindset around security. This attack wasn’t about the latest exploit—it was about the oldest flaw of all: human complacency. Until we start treating security as a proactive, ongoing process rather than a checkbox exercise, incidents like this will continue to happen. And if we’re not careful, the next one might not just be a minor disruption—it could be a catastrophe.
