Cyberattack on Polish energy sites (December 2025)
Destructive attack of December 29 and 30, 2025 on some thirty Polish energy sites, attributed to Russia by three successive voices that did not name the same service.
On December 29 and 30, 2025, a purely destructive operation hit some thirty renewable energy installations, a combined heat and power plant serving nearly 500,000 customers and a manufacturing company in Poland. For underwriting, the case matters less for the attack than for the way it was attributed, in three layers that do not coincide. Political attribution came from the state where the systems were located, the one the LMA 5564 to 5567 clauses point to: on January 13, 2026, the deputy prime minister attributed the attack to Russia. Technical attribution came from separate and diverging actors: the private vendor ESET linked the DynoWiper wiper to the Sandworm group, tied to military intelligence, with medium confidence, while the national CERT Polska team linked the operation to the FSB. Formal attribution, with legal consequences, came on July 13, 2026, when the United Kingdom and the European Union named FSB Center 16 in a joint sanctions package. Not to be confused with an attack on war infrastructure: Poland was party to no armed conflict, and it was the cyber operation exclusion, not the war exclusion, that was at stake. Where the term is read: in discussions of attribution delay and of the notion of the impacted state.
Two weeks separate the attack from attribution by the state where the systems were located (January 13, 2026, reported by The Moscow Times and Notes from Poland), six and a half months from the joint formal attribution (July 13, 2026, UK government release and The Record): a claim filed in January was being settled while the attribution was still changing services.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.