Incident explainer · Poland, December 2025

When “isolated” isn’t isolated: the private APN attack on Poland’s energy sector

Name: When “isolated” isn’t isolated: the private APN attack on Poland’s energy sector
Uploaded: 2026-10-01
Duration: 5 min 17 s
Description: How attackers crossed a shared private cellular network (APN) to stop a heat and power plant serving 50,000 residents, why an APN is a transport network and not a security boundary, and the six controls that close the gap.

5:17 minOctober 2026Cellular and APNRemote accessEnergyIEC 62443

How attackers crossed a shared private cellular network (APN) to stop a heat and power plant serving 50,000 residents, why an APN is a transport network and not a security boundary, and the six controls that close the gap.

Key takeaways

01Remote sites with a cellular router are not air-gapped, whatever the drawings say.
02A private APN without client isolation is one flat network shared by every site on it.
03The path in: a VPN without MFA, a cellular router, the shared APN, then a controller with its default password.
04Treat every APN as untrusted, segment the router into its own zone, and audit the path, not just the perimeter.

Sources: CERT Polska follow-up report (August 2026).