Cyber Incident Victim: Poland's War Studies University
Date:
Apr 2020
Location:
Poland
Summary
A cyberattack breached an elite Polish military academy's website, followed by a disinformation campaign involving a forged letter falsely claiming U.S. forces in Poland constituted an 'American occupation.' Polish security services suggested possible Russian government involvement, noting the operation's alignment with known Russian disinformation tactics, though no conclusive attribution was provided. The fabricated letter was publicly debunked by independent journalists. U.S. officials condemned the incident, while NATO emphasized heightened vigilance. Cybersecurity analysts observed signs of coordination in the operation. Moscow denied responsibility, consistent with its responses to similar past incidents involving forged documents and influence campaigns targeting other nations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late April 2020, hackers breached the website of Poland’s War Studies University, an elite military academy. Following the breach, a disinformation campaign emerged featuring a fabricated letter falsely attributed to the university. The letter claimed U.S. forces stationed in Poland constituted an "American occupation," aiming to sow discord between the NATO allies. The forgery was publicly exposed by AFP journalists through fact-checking efforts. Polish security services, represented by Minister-Special Services Coordinator spokesman Stanislaw Zaryn, announced the incident on April 28, 2020, linking the operation to Russian government operatives based on tactical patterns. While Polish authorities stopped short of definitive attribution, they emphasized the campaign's alignment with known Russian disinformation methodologies, referencing historical precedents like forged diplomatic correspondence and influence operations in Georgia and EU states. The cyberattack-disinformation combination suggested coordinated execution, as noted by cybersecurity analyst Lukasz Olejnik.
The incident triggered diplomatic responses from multiple stakeholders. U.S. officials formally condemned the attack, reinforcing bilateral ties with Poland. NATO leadership issued statements highlighting increased vigilance against hybrid threats targeting member states. The fabricated letter’s content specifically attempted to undermine military cooperation between Washington and Warsaw at a time when U.S. troop deployments in Poland remained strategically sensitive. Russia’s government denied involvement through standard diplomatic channels, mirroring its responses to prior allegations of cyber operations. The War Studies University’s reputation as a premier defense institution faced temporary scrutiny due to the website compromise, though no data theft or secondary cyber effects were disclosed. Polish counterintelligence services monitored subsequent information ecosystems for related disinformation attempts while reinforcing cybersecurity protocols for governmental and military digital assets.