Password-only remote access let the attackers in: Poland's grid attack exposes the gap in Europe's cyber defence
When Europe's own power and cybersecurity organisations met at the ninth cybersecurity forum in Brussels in October 2026, the message was unusually concrete: geopolitical attacks, artificial intelligence, and rapid growth in connected energy technologies are creating risks that regulation alone cannot handle. The forum, jointly organised by E.DSO, EE-ISAC, ENCS and ENISA, used three concrete examples — the coordinated attacks on Polish energy infrastructure in December 2025, Ukrenergo's AI-assisted defence under wartime conditions, and a demonstration of how solar inverters and home batteries with unauthenticated control protocols can become an attack vector — to argue that the sector must shift its focus from compliance to practical resilience.
The picture behind the forum
The forum came just weeks after ENISA published its threat report "Threat Landscape 2026", which analysed 8,257 cyber incidents affecting EU member states and organisations in the EU during 2025. The report concluded that geopolitical developments continue to shape malicious cyber activity, that attackers are increasingly using AI in their operations, and that the number of reported intrusion attempts against operational technology (OT) is rising, according to Industrial Cyber.
The experts gathered in Brussels argued, according to the same source, that Europe's energy sector must close the gap between rapidly evolving cyber threats and the ability to respond in practice. Around the same time, research emerged that quantifies the vulnerability: the Dutch national cybersecurity centre (NCSC) and the company Modat found 8,547 control systems in power plants accessible from the public internet in 35 of the 40 countries they examined, with full control possible at approximately 181 locations, according to Tomorrows Affairs.
How the attack on Poland actually happened
The forum reviewed the coordinated cyber attacks on Poland's energy sector in December 2025 — with first-hand accounts from those affected. The attack, which CERT Polska dates to 29 December 2025, hit more than 30 wind and solar park facilities and a combined heat and power plant that supplies heat to nearly half a million customers.
The consequence was serious, but not what one might first assume: electricity generation was not disrupted, but communication between the affected facilities and the distribution system operators (DSOs) was severed. The attackers obtained a level of access that, according to Industrial Cyber, could have enabled disruptions.
The entry method is perhaps the most instructive part: the attackers got in via remote-access devices that were reachable from the internet and protected only by a password, with no additional identity verification. They also used facility management computers that still had factory-set passwords. In other words: not a sophisticated technical breakthrough, but an exploitation of basic configuration weaknesses.
Who was behind it? Here the picture is unclear. CERT Polska attributes the attack to a group called Static Tundra, which is linked to a unit under Russia's security service, the FSB. The security companies ESET and Dragos, on the other hand, attribute the attack to Sandworm — a group linked to Russian military intelligence — with moderate confidence. The sources do not say whether these are distinct or overlapping actors, and that remains an open question.
AI on both sides of the front
The ENISA report describes AI as an attacker's tool. But the forum also showcased AI as a defensive tool. Ukrenergo, the Ukrainian transmission system operator, uses AI to help cybersecurity teams react faster, identify weaknesses, support staff, and assist with reporting. Critical decisions are kept with humans, according to the company.
This is perhaps the most practical lesson from the forum: while European organisations discuss regulation, their Ukrainian colleagues are working with AI tools in a system under attack — and they shared their experiences directly with the audience in Brussels.
From smart homes to grid stability
The third exhibit at the forum was perhaps the most forward-looking — and the most carefully worded. ENCS researchers demonstrated how a compromised smart-home device, such as a router or a camera, could potentially be used to communicate with a private solar inverter or home battery.
The underlying problem is authentication: some of these energy devices use control protocols that do not themselves authenticate who or what is sending a command. An attacker therefore does not necessarily need to hack the inverter or battery directly in order to potentially influence whether it produces, consumes, or stores power.
The ENCS researchers were clear about what the demonstration does not show: compromising a single household is unlikely to affect the grid. But if thousands of devices are manipulated simultaneously, it could create sudden shifts in power generation or demand, and potentially contribute to broader grid disturbances. This is thus a prospective vulnerability, not a documented real-world attack — a distinction that is important to hold on to.
What should be done?
Harm van den Brink, a security researcher at ENCS, offered a concrete proposal:
"More high-power IoT devices are deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the power grid. In the short term, we need independent security testing, prioritised by the amount of power that could potentially be affected, combined with vulnerability management from the manufacturers," van den Brink said, according to Industrial Cyber.
Prioritising by potentially affected power is a useful framework: not all vulnerabilities are equally important, and a flaw in a device that can move significant power is worse than one in a small unit. Combined with manufacturers taking responsibility for vulnerability management, this offers a practical path forward that does not depend on new legislation alone.
Dimitra Liveri, head of the unit for resilience in critical sectors at ENISA, summed up the broader challenge:
"We need to move from protecting individual systems to optimising the whole ecosystem for cybersecurity resilience," Liveri said.
This is a deliberate shift in perspective: instead of assuming that every single facility or device must be hack-proof, the question is how the grid as a system can tolerate parts of it failing or being compromised.
Open questions
Several matters still require clarification. The attribution of the Poland attack is unresolved: CERT Polska points to Static Tundra (FSB), while ESET and Dragos point to Sandworm (Russian military intelligence) with moderate confidence, and the relationship between these names is unclear. The ENCS scenario is a demonstration and a hypothesis about future risk — no documented real-world incident is known. The NCSC/Modat figures are available only through secondary sources.
It is also worth noting that coverage of the forum appears to draw largely on the same press material, and that no primary sources from the organisers are available in the accessible material — meaning the figures and quotes here rely heavily on Industrial Cyber and Tomorrows Affairs.
Nevertheless, the forum points in a clear direction: Europe's energy sector is shifting from asking "are we meeting the requirements?" to "can we withstand the attack?". The December attack on Poland showed that today the answer is nuanced — generation held, but communication was lost. And it is precisely this gap, between what fortunately did not happen and what could have happened, that the forum sought to close.