Poland's renewable energy facilities

Profile narrative

The organisation operates renewable energy facilities across Poland, focusing on wind and solar power generation as well as photovoltaic installations. Its core activity is the production of electricity from these renewable sources for delivery to the national grid. By managing wind farms, solar farms and PV facilities, it contributes to Poland’s renewable energy capacity and supports the country’s transition to low‑carbon power. The facilities are situated in various regions of Poland, though specific numbers or geographic extent are not disclosed in the source material.

These facilities rely on industrial control systems to monitor and operate turbines, inverters and related equipment, integrating operational technology with corporate networks for remote management. In December 2025, attackers exploited internet‑exposed FortiGate VPN devices that lacked multi‑factor authentication and used default credentials, gaining access to the OT environment at wind and solar farms, a combined heat and power plant and a manufacturing firm. The intrusion led to firmware corruption, file deletion, device resets to factory settings and the deployment of wiper malware on Windows hosts, which disrupted communication with grid operators while leaving electricity generation uninterrupted. Polish CERT attributed the activity to a Russia‑linked threat group also identified as Sandworm or Electrum by other vendors.

The incident highlights the organisation’s exposure to cyber‑physical risks typical of modern energy infrastructure that blends renewable generation with networked control systems. It also underscores the importance of securing remote access points, such as VPNs, with strong authentication and credential hygiene in the renewable energy sector. While the organisation’s ownership structure, parent‑subsidiary relationships or exact market share are not detailed in the available information, its role as a producer of wind, solar and photovoltaic power places it within Poland’s broader energy market. The attack demonstrates that even facilities focused on clean energy can be targeted by sophisticated state‑linked actors seeking to impair operational reliability.

Incidents

1 incident linked to this organisation.