Russian hackers target Polish hydroelectric plant for the second time

The power plant is located near Gdańsk, in the north of the country, and it was not difficult to trace who was behind it.

The hackers themselves published a video showing how they managed to manipulate the plant’s interface, cybernews reported.

Based on the video and technical details, it’s most likely that hackers attacked a small hydroelectric power plant in Tczew. Its turbine type, head, and installed power match the data seen in the attack footage.

Here’s how it happened. Once in the system, hackers were able to change operational parameters to their minimum or maximum values. This forced the generator and rotor – the part of the plant’s turbine that spins when water flows through it – to stop.

The turbine’s RPM (a measurement that shows how fast something, such as a turbine, is spinning) and power output started behaving in unusual and unlikely ways.

This data allowed Polish analysts to conclude that the hack had a real impact on plant operations by successfully causing disruption – it was not a simulation or a test. On the day of the attack, monitoring data showed rapid spikes in turbine speed and water level, along with periods of zero power output.

The same plant was also targeted in May, but hackers failed to gain full control. The plant was offline at the time, limiting the impact that the hackers could have. The latest attacks, which were likely to have happened on 10 August 2025, mark the first time the cybercriminals have successfully interfered with the plant while it was fully operational.

As CyberDefence24 reports, attacks on Polish industrial automation systems are beginning to show consistent patterns. In just the last couple of months, hackers have launched attacks on water treatment plants in Szczytno, Sierakowo, Witków, and the sewage treatment plant in Kuźnica. Some swimming pools and fountains have also been targeted.