BreachPublished 8 May 2026

Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants

Source SecurityWeek

Description

The hackers gained the ability to modify equipment operational parameters, creating a direct risk to the public water supply. The post Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants appeared first on SecurityWeek .

Impact

The attackers' ability to modify operational parameters of water treatment equipment creates a direct risk to the safety and continuity of the public water supply in affected municipalities. This could lead to disruption of water services or contamination risks if exploited. The breaches also indicate systemic security weaknesses in ICS environments, particularly weak authentication and internet exposure. The attribution to state-sponsored groups suggests a high level of threat sophistication and potential for further critical infrastructure targeting. No known exploits in the wild have been reported to date.

Defensive guidance

The report identifies weak password policies and internet-exposed ICS systems as primary attack vectors. Organizations should immediately review and strengthen password policies and eliminate direct internet exposure of ICS devices. Monitoring and restricting remote access, implementing network segmentation, and applying strong authentication controls are recommended. Check for any updated vendor or government advisories for additional guidance. No indication that the issue is already mitigated or patched was provided.

Summary

In 2025, the Polish Internal Security Agency documented cyberattacks targeting ICS at water treatment plants in multiple municipalities, including Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, and Sierakowo. Attackers obtained access allowing modification of equipment operational parameters, threatening water supply safety. The primary attack vectors were weak password policies and direct internet exposure of ICS systems. The incidents are linked to Russian APT groups such as APT28 and APT29, and Belarusian-linked UNC1151. The report also notes increased attacks on other municipal utilities and supply chains, with attackers seeking contract data and credentials. No detailed technical exploitation data or patches were provided.

References

securityweek.com/polish-security-agency-reports-ics-breaches-at-five-water-treatment-plants/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 11:51 UTC

References

Community reviews