In 2025, the Polish Internal Security Agency documented cyberattacks targeting ICS at water treatment plants in multiple municipalities, including Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo. Attackers obtained access allowing modification of equipment operational parameters, threatening water supply safety. The primary attack vectors were weak password policies and direct internet exposure of ICS systems. The incidents are linked to Russian APT groups such as APT28 and APT29, and Belarusian-linked UNC1151. The report also notes increased attacks on other municipal utilities and supply chains, with attackers seeking contract data and credentials. No detailed technical exploitation data or patches were provided.

The attackers' ability to modify operational parameters of water treatment equipment creates a direct risk to the safety and continuity of the public water supply in affected municipalities. This could lead to disruption of water services or contamination risks if exploited. The breaches also indicate systemic security weaknesses in ICS environments, particularly weak authentication and internet exposure. The attribution to state-sponsored groups suggests a high level of threat sophistication and potential for further critical infrastructure targeting. No known exploits in the wild have been reported to date.

The report identifies weak password policies and internet-exposed ICS systems as primary attack vectors. Organizations should immediately review and strengthen password policies and eliminate direct internet exposure of ICS devices. Since no official patch or fix is referenced, remediation focuses on improving OT security hygiene. Monitoring and restricting remote access, implementing network segmentation, and applying strong authentication controls are recommended. Check for any updated vendor or government advisories for additional guidance. No indication that the issue is already mitigated or patched was provided.