Cyber Incident Victim: Poland
Date:
Aug 2025
Location:
Poland
Summary
Deputy Prime Minister Krzysztof Gawkowski disclosed that an attack targeting the water and sewage network of a sizable city in the country was intercepted before it could disrupt supply, with authorities learning of the intrusion at the last moment and shutting down the affected systems to avert a possible water shortage. He refrained from naming the locality to prevent public alarm, noting that such incidents have become more frequent following heightened cyber threats against the country’s infrastructure. The public announcement aims to raise awareness among operators of industrial control systems about the need for robust protective measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On Wednesday, August 13, 2025, a cyberattack targeted the water and sewage infrastructure of one of Poland’s larger cities. The deputy prime minister, Krzysztof Gawkowski, disclosed the incident during an appearance on the program “Onet Rano.” on August 14, 2025. He stated that the services learned of the attack at the last moment and managed to shut down the affected systems. According to Gawkowski, the timely detection allowed authorities to prevent the attack from progressing. He emphasized that the intervention occurred just as the attack was beginning, avoiding any disruption to water supply.
Gawkowski warned that, had the attack succeeded, the city could have been left without water. He declined to name the specific city, citing a desire to avoid causing public alarm. The deputy prime minister highlighted that public disclosure of such incidents aims to raise awareness among operators of industrial automation systems about the ongoing threat. He stressed the importance of implementing appropriate protective measures by those responsible for critical infrastructure. Referring to the broader security environment, Gawkowski noted that cyberattacks against Poland and its infrastructure have increased since Russia’s invasion of Ukraine in 2022. He mentioned that prosecutors had previously filed an indictment against six individuals, including three Poles and three Belarusians, in connection with earlier sabotage acts. Prosecutor Nowak clarified that the charges relate to incidents that occurred about a year earlier and that he has no knowledge of newer events covered by those accusations. He expressed hope that the perceived rise in such activity had been limited to the previous year and that accountability is now being pursued.