Cyberattack on Polish energy grid impacted around 30 facilities

BleepingComputer

January 28, 2026 at 10:14 PM

Actively Exploited

Overview

In late December, Poland's energy grid experienced a coordinated cyberattack that affected around 30 facilities nationwide. The attackers targeted various distributed energy resources, including combined heat and power plants, as well as wind and solar energy systems. This incident raises concerns about the security of critical infrastructure, as energy systems are essential for everyday life and economic stability. The attack not only disrupted operations but also highlighted vulnerabilities in the energy sector that could be exploited in the future. Authorities are likely to investigate the incident further to bolster defenses against potential future threats.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Combined heat and power (CHP) facilities, wind and solar dispatch systems
Timeline: Ongoing since late December 2023

Original Article Summary

The coordinated attack on Poland's power grid in late December targeted multiple distributed energy resource (DER) sites across the country, including combined heat and power (CHP) facilities and wind and solar dispatch systems. [...]

Impact

Combined heat and power (CHP) facilities, wind and solar dispatch systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since late December 2023

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Read Original Article

Related Coverage

Critical n8n flaws disclosed along with public exploits

BleepingComputer

Researchers have identified multiple serious vulnerabilities in n8n, a widely used open-source workflow automation platform. These flaws could enable attackers to escape the security measures of the software, potentially giving them complete control over the host server. This poses a significant risk to users, especially those running n8n in production environments. If exploited, these vulnerabilities could lead to unauthorized access and data breaches, impacting businesses that rely on n8n for automation tasks. Users are strongly advised to assess their systems and implement necessary security measures as soon as possible.

Feb 4, 2026

Taiwanese operator of Incognito Market sentenced to 30 years over $105M darknet drug ring

Security Affairs

Rui-Siang Lin, a 24-year-old Taiwanese man, has been sentenced to 30 years in prison for his role in operating Incognito Market, a significant darknet drug marketplace. This platform facilitated the sale of over one ton of illegal drugs, amounting to more than $105 million in transactions. Lin was found guilty of various charges, including conspiracy to distribute narcotics. The case illustrates the ongoing challenges law enforcement faces in combating illicit online drug trade and underscores the risks associated with the anonymity provided by darknet platforms. The long sentence reflects the severity of his actions and serves as a warning to others involved in similar activities.

Feb 4, 2026

Half of Chrome AI extensions are harvesting your data - see the surprising worst offenders

CISA: VMware ESXi flaw now exploited in ransomware attacks

BleepingComputer

CISA has reported that ransomware gangs are now exploiting a serious vulnerability in VMware ESXi, which allows attackers to escape sandboxes and gain unauthorized access to systems. This vulnerability, which had previously been used in zero-day attacks, poses a significant risk to organizations using affected VMware products. Companies relying on VMware ESXi for virtualization need to be particularly vigilant, as attackers are actively targeting this flaw. The exploitation of such vulnerabilities can lead to severe data breaches and financial losses. Organizations should prioritize patching their systems to mitigate this risk and protect sensitive data from potential ransomware attacks.

Feb 4, 2026

Global SystemBC Botnet Found Active Across 10,000 Infected Systems

Infosecurity Magazine

Researchers have identified the SystemBC malware, which is currently active across approximately 10,000 infected systems. This botnet is particularly concerning as it poses risks to sensitive government infrastructure, potentially exposing critical data and functionalities to malicious actors. The malware's widespread presence raises alarms about the security of various networks, especially those that manage important public services. Organizations, particularly in the public sector, need to take immediate action to secure their systems against this threat. Failure to address this could lead to significant operational disruptions and data breaches.

Feb 4, 2026

UK investigates X over Grok AI's nonconsensual image generation

SCM feed for Latest

The UK's data protection authority has initiated an investigation into X and its Irish subsidiary over allegations that the Grok AI assistant was utilized to create nonconsensual sexual images. This raises serious concerns about privacy and consent, particularly in how AI technologies are being employed. The investigation aims to determine whether X has violated data protection laws, especially regarding the generation of harmful content without individuals' consent. The implications of this investigation could lead to stricter regulations on AI use and accountability for companies developing such technologies. Users and stakeholders are closely watching this case, as it could set precedents for how AI-generated content is governed.

Feb 4, 2026