A compromised firewall at a Polish wind farm reached the control systems of a power plant that heats roughly 50,000 residents, because the private cellular network connecting the two sites had no client isolation.
CERT Polska calls it the first observed use of a private APN as an attack vector in a real-world intrusion.
Key Facts
- Attack chain: a FortiGate firewall and VPN, a Teltonika cellular router, a WAGO controller, and three Siemens PLCs (S7-300, S7-1200, S7-1500).
- Scanning began December 18, 2025. The Siemens controllers were forced into stop mode and password-locked eleven days later, on December 29.
- CERT Polska says the same misconfiguration, no client isolation on a private APN, is common in Poland and used elsewhere, as reported by Help Net Security.
- The plant's turbine and water treatment system went offline. Heat supply was never interrupted; staff restored from backups.
Why It Matters
Private APNs are a standard way to give OT and utility equipment cellular connectivity without routing it across the public internet. A July 2026 FBI and EPA advisory lists them among the isolated architectures operators should consider for OT equipment reachable over cellular links. Ownership and reachability are different questions, though. A privately owned network can still let every device on it reach every other device. Client isolation is the setting that actually prevents that, and it has to be configured and verified like any other control. For an attacker, that gap is an assumption defenders rarely test.
What Happened
The intrusion began at a wind farm substation, according to CERT Polska's August 8, 2026 disclosure. An attacker compromised a FortiGate firewall and VPN concentrator there, then pivoted through a Teltonika cellular router onto a private APN run by the regional distribution system operator.
The APN had no client isolation, so the attacker scanned across it freely. That scan turned up a WAGO controller at at a separate site on the same APN, a combined heat and power plant, with its web administration interface exposed and still set to the default administrator account. The attacker used that access to enable SSH on the controller, then bridged into the plant's Siemens control systems.
Scanning began December 18, 2025. Eleven days later, on December 29, the attacker forced three Siemens PLCs into stop mode and set a new administrator password so operators could not immediately reverse it. None of it required malware. Every destructive step used a function the devices already supported, and CERT Polska says the timing shows, with high confidence, that the sequence was automated.
The turbine and water treatment system went offline. Recovery began around 7:30 a.m. that same morning, while the intruders were still active inside the network, and heat supply to the plant's roughly 50,000 residents was never interrupted.
CERT Polska has not named an actor for this specific intrusion. It happened the same day, December 29, 2025, as coordinated attacks on roughly 30 other Polish energy facilities, Help Net Security reported, part of a broader campaign that led the UK and EU to impose their first joint cyber sanctions package on Russia in July 2026.
Attack-Chain Diagram
Source: CERT Polska, Energy Sector Incident Follow-up Report
Technical Cause
The compromised firewall was one failure. The bigger one was assuming a private cellular network doesn't need the same segmentation discipline as a corporate LAN. That single assumption is what let every step after it succeed, laid out below.
Governance and Risk Implications
For security leaders overseeing OT or utility environments, this incident raises three governance questions above the technical detail.
1. A vendor's claim that a network is "private" is not a verified control
A private APN provisioned by a utility, telecom provider, or other third party is still a network boundary decision, and it deserves the same scrutiny as a leased line or an internet-facing connection. "Private" describes who owns the network. It says nothing about whether client isolation is actually enabled.
2. Default credentials remain a single point of failure regardless of network privacy assumptions
The WAGO controller's default administrator credentials converted network access into full device control in one step. Credential hygiene on field controllers matters regardless of how private the surrounding network is.
3. Shared infrastructure widens the blast radius of a single mistake
When a utility's private network connects an operator's own sites to a customer's plant on the same segment, one compromise can cross an organizational boundary neither side agreed to share. The same root problem, OT reachable through a network the operator doesn't own, showed up differently in Entropya's CEOTW on exposed US water-sector PLCs. Carrier-provisioned cellular links carried the risk there instead of a private APN.
Secure Architecture Response
Any security architect can apply this without a vendor conversation: verify client isolation on every shared network your OT or field equipment connects to, cellular included. Don't take "private" as a synonym for "segmented." Confirm it with an actual scan, not an assumption inherited from the network provider.
Every step of this intrusion depended on the attacker seeing and reaching a device it had no business touching: the firewall, the cellular router, the WAGO controller. Entropya's answer to that problem is Digital Camouflage, an approach built to reduce what infrastructure can be discovered, mapped, and reached in the first place, so there is less for reconnaissance like this to find.
At the edge, where this incident started and where OT and IoT devices most often connect through vendor-managed networks, Entropya's IEG Router (Iron Edge Gateway) complements or, where feasible, replaces the firewall and VPN model that provided the attacker with access. The IEG Router authenticates connected systems into the Entropya Encrypted Network (EEN), Entropya's proprietary quantum resilient software-defined network. The EEN dual-encrypts traffic and hides real IP addresses regardless of whether the underlying private network is isolated, keeping sessions untraceable and reducing what's discoverable and reachable behind it.
Best Practices
Ask these of your own environment rather than treating the checklist as generic:
- Do you know every cellular or private network connection into your OT environment, including ones a utility or carrier manages on your behalf?
- Have you confirmed client isolation is enabled, tested from a device on the network, rather than assumed because the provider called it private?
- Are default administrator credentials still active on any field controller reachable from a shared network?
- If one site on that network were compromised today, do you know exactly which other sites it could reach?
Review Your OT Exposure
A private label on a network is not a segmentation control. Review whether your OT and cellular connections are more reachable than they should be.
Frequently Asked Questions
An attacker compromised a firewall and VPN at a Polish wind farm, then used a shared private cellular network (APN) with no client isolation to reach a combined heat and power plant at an unrelated site. The attacker forced Siemens controllers into stop mode eleven days after the initial pivot. Heat supply to the roughly 50,000 residents served by the plant was never interrupted.
Client isolation is a network configuration that prevents devices connected to the same private network from communicating with each other directly. Without it, any device on the network can attempt to scan and reach any other device, regardless of which organization or site it belongs to.
Private APNs are commonly used to give distributed OT and utility equipment cellular connectivity without exposing it to the public internet. CERT Polska found that the same lack of client isolation used in this attack is common in Poland and used elsewhere, meaning many private APNs may permit the same kind of cross-site reachability this incident exploited.
Lateral movement like this is possible because of a discoverability and reachability gap, not a missing network control on its own. Devices that should never have been able to see or reach each other could. Entropya's Digital Camouflage principle addresses that earlier stage, reducing what connected infrastructure can be found, mapped, and reached before an attacker gets a foothold to exploit.