The biggest cyber attacks in Poland (2020–2026)

In brief: Cyber attacks on Polish organizations (cyberataki w Polsce) are rising fast, and the figures are public. CERT Polska, the national incident response team run by NASK, registered 260,783 incidents in 2025, which is 152% more than a year earlier. Behind those numbers sit a handful of attacks that changed how Poland thinks about security: the CD Projekt ransomware, the ALAB medical data leak, a false mobilisation dispatch on the state news agency PAP and a destructive attack on more than 30 wind and solar farms in December 2025. Below: the twelve best documented cases, what they have in common and what they mean under Poland’s NIS2 law.

The biggest attacks at a glance

Timeline: the attacks that shaped Polish cybersecurity

2021: CD Projekt and the minister’s mailbox

On 9 February 2021, CD Projekt, the studio behind The Witcher and Cyberpunk 2077, announced that part of its network had been encrypted and that the attackers claimed to hold the source code of its games. The company said it would “not give in to the demands nor negotiate” and restored from intact backups. In June 2021 the security services ABW and SKW stated that the group UNC1151 had targeted more than 4,000 Polish email accounts with social engineering, over 100 of them belonging to politicians and officials. One was the mailbox of Michał Dworczyk, then head of the Prime Minister’s Chancellery, whose emails were later published online.

2022 and 2023: a Łódź hospital, the railways and ALAB

At the end of October 2022 the Instytut Centrum Zdrowia Matki Polki in Łódź switched off part of its IT systems to contain an attack and went back to paper records. On 25 August 2023 an unauthorised “radio-stop” signal, an emergency brake command sent over the railway radio, delayed about 20 trains around Szczecin. No computer was hacked, but it showed how exposed older railway systems are. On 19 November 2023 the laboratory chain ALAB Laboratoria was hit. The group RA World published test results of tens of thousands of patients from 2017 to 2023, with PESEL numbers and addresses. ALAB refused to negotiate.

2024: a false dispatch on the state news agency

On 31 May 2024 the wire of the Polska Agencja Prasowa (PAP) twice carried a dispatch claiming that Poland would announce a partial mobilisation on 1 July and send 200,000 citizens to Ukraine. It was false and was withdrawn both times. According to RMF FM, the attackers had taken over the account of a PAP employee with malware. Digital affairs minister Krzysztof Gawkowski said the attack was most likely the work of “the Russian side”. The Warsaw prosecutor’s office opened an investigation and handed it to ABW.

2025: EuroCert, the space agency, a Kraków hospital and a city’s water

In the night of 12 January 2025, ransomware encrypted the servers of EuroCert, one of the few Polish providers of qualified electronic signatures. PESEL numbers, ID card numbers and login details of customers and employees were exposed, and the government told EuroCert’s customers to change their credentials. Media reports attributed the attack to the RansomHub group, which claimed to hold 65 GB of data. On 2 March the Polish Space Agency (Polska Agencja Kosmiczna, POLSA) disconnected its network from the internet after an intrusion. On 8 March the interior ministry’s hospital in Kraków (Szpital MSWiA) was hit by ransomware; its director spoke of a recovery in “days and weeks, not hours”. And on 13 August an unnamed large city almost lost its water supply, Gawkowski said a day later. The attack was stopped in time.

December 2025: wipers against wind and solar farms

On 29 December 2025 a coordinated attack hit at least 30 wind and photovoltaic farms, a combined heat and power plant that heats almost half a million customers, and a manufacturing company. The aim was destruction, not ransom. Attackers wiped controllers and reset devices, which cut the link between the farms and the grid operators, and tried to run wiper malware called DynoWiper in the plant, where security software blocked it. No electricity or heat was lost. The entry point in the CERT Polska report, as summarised by Help Net Security, was mundane: internet-facing FortiGate devices whose VPN accepted logins without multi-factor authentication.

2026: hospitals and patient data

Within 25 days in March 2026, ransomware hit the regional hospital in Szczecin, the Bonifraterskie Centrum Medyczne group with hospitals in Katowice, Kraków and Łódź, and two smaller care providers. In August, Gawkowski convened the national cybersecurity operations centre over a possible leak at MyDr, which supplies software to doctors’ practices. Media mentioned data of up to 19 million people, a figure that has not been confirmed. In October, attackers exploited a flaw in a grant application system of the Ministry of Culture with about 24,000 registered users. In early November 2026 the ministry was still analysing whether data had been copied.

What the Polish cases have in common

• The way in is a login, not a zero-day. At PAP it was an employee’s account, in the 2021 campaign social engineering, in the energy attack VPN accounts without a second factor. That is why training and MFA come first.
• Healthcare takes the hardest hits. Łódź in 2022, ALAB in 2023, Kraków in 2025, four organizations in one month in 2026. The sector’s own response team, CSIRT CeZ, counted 1,441 incidents in 2025, over 60% more than in 2024.
• Suppliers multiply the damage. EuroCert, MyDr and the processor hosting the Ministry of Culture system each exposed customers who had done nothing wrong themselves.
• Refusing to pay is the public norm. CD Projekt and ALAB both said no. CD Projekt could, because its backups were intact.

CERT Polska and the numbers behind the headlines

CERT Polska is part of the research institute NASK and acts as CSIRT NASK, one of three national incident response teams next to CSIRT GOV (run by the security service ABW) and CSIRT MON (the military). In 2025 it received 658,320 reports and registered 260,783 incidents, against 103,449 in 2024. Computer fraud, mostly phishing and fake investment sites, made up 97%. It also counted 179 ransomware incidents, roughly one every two days. All national teams together handled almost 273,000 incidents in 2025, according to the annual report of the Ministry of Digital Affairs.

The geopolitical context, as Polish authorities describe it

Polish officials openly link part of this activity to Russia and Belarus. ABW and SKW attributed the 2021 mailbox campaign to UNC1151 and tied the group to Russian secret services. After the PAP dispatch, the prosecutor’s office spoke of people acting for a foreign intelligence service. The government’s summary of the CERT Polska report calls the energy attack long prepared and state-linked, and connects it to the clusters known as Static Tundra, Berserk Bear, Ghost Blizzard and Dragonfly. Two caveats. Attribution is an assessment by services and analysts, not a court verdict. And the hospital ransomware of 2026 is treated by the police as the work of a criminal group that is after money.

What this means for Polish companies under the new KSC Act

Since 3 April 2026 Poland has its NIS2 law: the amended National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC). It turns the lessons above into duties for key and important entities in sectors from energy and healthcare to manufacturing and food: risk management, supply chain security, multi-factor authentication, incident reports within 24 and 72 hours, education for staff and yearly training for management. The full obligations apply from 3 April 2027. Our NIS2 guide explains the scope, deadlines and fines. The biggest attacks in Germany, the Netherlands and Spain show the same patterns.

The human factor: what to train Polish teams for

1. Phishing in flawless Polish. The ministry’s annual report describes phishing written with AI, without spelling mistakes, and deepfake voices of managers. Practise with the types of phishing attacks they actually face.
2. Testing instead of assuming. Phishing simulations show who would click before an attacker finds out. Guardey combines them with a weekly challenge and a team competition, in many languages, with reporting that auditors accept for NIS2 and ISO 27001.
3. A second factor on everything that faces the internet. The December 2025 attackers logged in through a VPN without multi-factor authentication.

Frequently asked questions

What was the biggest cyber attack (cyberatak) in Poland?

By potential impact, the attack of 29 December 2025 on more than 30 wind and solar farms and a heat and power plant. By sensitivity of the data, the ALAB leak of 2023. By political weight, the false mobilisation dispatch on PAP in May 2024.

How many cyber attacks are there in Poland per year?

CERT Polska registered 260,783 incidents in 2025, 152% more than in 2024. All national response teams together handled almost 273,000.

Who is behind the hacker attacks (ataki hakerskie) on Poland?

Mostly criminals: 97% of what CERT Polska registers is computer fraud such as phishing. Polish authorities attribute several high-profile attacks, including the energy attack of December 2025, to state-linked groups and point to Russia and Belarus.

Where do you report a cyber attack in Poland?

Companies and citizens report to CERT Polska (CSIRT NASK), and suspicious text messages can be forwarded to 8080. Key and important entities under the KSC Act report serious incidents through the government’s S46 system.