Hackers breached a Polish heat plant through the utility's own private cellular network
CERT Polska says hackers shut down a steam turbine and water treatment system at a heat plant serving 50,000 residents, entering through the utility's own private cellular network. Investigators call it the first confirmed real-world case of this attack path.
A Polish combined heat and power plant serving fifty thousand residents lost its turbine and water treatment system to hackers who broke in through the utility's own private cellular network, according to a CERT Polska report published this month. The intrusion started at a wind farm's exposed VPN, pivoted through a misconfigured private cellular network, and reached a plant controller still using its default password. CERT Polska calls it the first confirmed real-world case of an operational network being breached this way, and warns the same private network setup is common at utilities in multiple countries.