Poland's Water Crisis: Cyber Attacks and the U.S. Response

TL;DR

Pro-Russian hackers have repeatedly targeted Poland's water treatment plants since 2024, manipulating controls and causing temporary disruptions, with intelligence linking attacks to Russia.
These incidents expose vulnerabilities in industrial control systems, raising alarms for similar U.S. critical infrastructure like water utilities.
U.S. officials are urging enhanced cybersecurity measures, drawing lessons from Poland to prevent potential sabotage amid rising geopolitical tensions.

The Wave of Cyber Sabotage Hits Poland's Water Sector

Poland's critical infrastructure has become a battleground for cyber warfare, with water and sewage treatment plants repeatedly falling victim to sophisticated hacks. Starting as early as 2024, attackers—widely attributed to pro-Russian actors—have infiltrated operational technology (OT) systems at facilities across the country. These breaches have ranged from brief interruptions in water supply to manipulations of key parameters like filtration cycles and pumping thresholds, underscoring the fragility of automated water infrastructure.

Polish intelligence agencies, including the Internal Security Agency (ABW), have confirmed multiple incidents, with the most recent waves occurring through 2025. Hackers gained unauthorized access via exposed Human-Machine Interfaces (HMIs) visible on the public internet, exploiting weak security like eight-character password limits and unlimited brute-force attempts. In one chilling case, a thwarted attempt nearly shut down water supplies to one of Poland's 10 largest cities, highlighting the potential for widespread civilian impact.

Key Incidents: From "Malfunctions" to Public Exposés

The attacks unfolded in distinct phases. Early 2024 saw strikes on wastewater plants in places like Wydminy and Kuźnica. By winter-spring 2025, the focus shifted to potable water stations in Tolkmicko, Małdyty, Sieraków, and Szczytno. Attackers altered operational settings—cranking filters to maximum cycles or tampering with chemical dosing—then circulated videos on social media to amplify the chaos.

A notable example came from the sewage treatment plant in Chodaczów, where locals initially mistook the disruption for a mechanical failure, leading to temporary water shortages. In September 2025, footage from