The Polish Power Plant Hack That Shut a Turbine Over a Private Network

Emily Davis · 2026-08-11

When you hear about critical infrastructure attacks, you probably picture something out of a spy movie—a shadowy figure typing frantically in a basement, or a nation-state launching a coordinated cyber campaign. But the reality is often quieter, and sometimes it happens over a network you'd never expect. That's exactly what unfolded at a combined heat and power plant in Poland. Attackers managed to shut down a steam turbine and the facility's process-water treatment system. Their entry point? The private cellular network the local grid operator uses to reach remote equipment. This isn't just a story about one plant in Eastern Europe. It's a wake-up call for anyone who relies on operational technology (OT) and industrial control systems (ICS)—and for anyone who thinks their private network is automatically secure. ### The Attack in Plain Sight Here's what happened: The intruders came in over a private LTE or 5G network—the kind of setup that's becoming more common as utilities modernize. These networks are meant to be isolated from the public internet, which gives operators a false sense of safety. But isolation isn't the same as security. The attackers gained access to remote equipment controls and started issuing commands. They shut down a steam turbine and disrupted the process-water treatment system. That's not a minor inconvenience. A steam turbine shutdown can ripple through the entire plant's operations, affecting everything from power generation to heating. The plant supplies heat to roughly 50,000 residents. That's a lot of people who could have been left in the cold. Fortunately, recovery efforts began around 7:30 a.m., while the intruders were still active inside the network. In the end, customers never lost heat. But the fact that the attackers were still inside the network during recovery is chilling. ### Why Private Cellular Networks Are a Double-Edged Sword Private cellular networks are a growing trend in industrial settings. They offer better coverage, lower latency, and more control than traditional Wi-Fi or wired connections. But they also introduce new attack surfaces. Here are a few reasons why these networks can become liabilities: - **They're often managed by third-party vendors** who may not follow strict security protocols. - **They rely on SIM cards and authentication mechanisms** that can be compromised if not properly configured. - **They're designed for convenience**, not necessarily for security, and many operators skip basic hardening steps. In this case, the attackers didn't need to breach a massive firewall or exploit a zero-day vulnerability. They found a way into a network that was supposed to be private—and that was enough. ### What This Means for Industrial Operators If you're running a plant, a utility, or any facility that depends on remote equipment, this incident should grab your attention. The Polish attack shows that even "private" networks can be entry points for determined adversaries. Some practical takeaways: - **Segment your networks.** Even within a private cellular setup, separate critical controls from less sensitive systems. - **Monitor for anomalies.** If someone is issuing commands at odd hours, you need to know about it in real time. - **Have a response plan.** Recovery shouldn't start after the attackers are done—it should be ready to go the moment you detect something unusual. ### The Human Element The most striking part of this story isn't the technology. It's the fact that recovery began while the attackers were still active. That means someone on the ground noticed something was wrong, raised the alarm, and started the process of regaining control while the threat was ongoing. That's not easy. It requires training, clear communication, and a culture that prioritizes safety over speed. The plant's operators managed to protect their customers, but they were lucky. The next time, luck might not be enough. ### A Lesson for the Rest of Us You don't have to run a power plant to learn from this. If you're using any kind of remote access—whether it's for a home security system, a small business network, or a personal VPN—the same principles apply. Private doesn't mean invisible. And invisible doesn't mean safe. Take a hard look at your own network. Ask yourself: If someone got in, would you even know? Could you respond while they were still inside? These are uncomfortable questions, but they're the ones that matter. The Polish power plant incident is a reminder that the line between physical and digital security is thinner than ever. A turbine doesn't care how the attacker got in. It just stops when told to stop. It's up to us to make sure that command never comes from the wrong hands.