Polish National Atomic Energy Agency and Health Ministry

Summary

Two Polish government websites were compromised and briefly displayed fabricated warnings of a radioactive leak from Lithuania, falsely claiming imminent health risks to citizens near the border. A journalist’s Twitter account was also breached to amplify the disinformation. A Polish security spokesperson attributed the incident to characteristics of a Russian cyber operation, noting similarities to a prior false alarm involving a non-existent Chernobyl radiation cloud. The messages aimed to sow discord among Western allies but garnered limited public attention. The targeted agency and ministry restored normal operations after the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 17, 2021, hackers compromised two Polish government websites—the National Atomic Energy Agency and the Health Ministry—briefly altering their content to disseminate fabricated claims of a radioactive emergency. The false statements alleged a nuclear waste leak originating in neighboring Lithuania that posed an imminent threat to Poland, specifically endangering residents near the Lithuanian border. Concurrently, attackers hijacked the Twitter account of an unnamed journalist specializing in Russian and Eastern European affairs to amplify the disinformation campaign. Polish authorities swiftly regained control of the affected websites and social media account, limiting the duration of public exposure. Stanisław Żaryn, spokesperson for Poland’s security services coordinator, characterized the incident as bearing hallmarks of Russian cyber operations aimed at sowing distrust among Western allies.

The fabricated messages warned of severe health risks to Polish citizens in the border region but failed to gain significant traction or public panic. Żaryn explicitly linked the attack to a similar 2020 incident where hackers spread false claims about a radioactive cloud moving toward Poland from Ukraine’s Chernobyl disaster site. Both incidents involved exploiting digital platforms to simulate environmental crises, though neither achieved widespread disruption. No technical details regarding the intrusion vectors, duration of unauthorized access, or specific defensive measures taken by Polish agencies were disclosed in available reporting. The government’s public response centered on attributing the activity to Russian tactics without providing forensic evidence, emphasizing historical patterns over newly identified indicators.

Sources

Sources available to members: 1 source.