The 2025 cyberattack on the Polish power grid began on 29 December 2025 and continued until the following day.
The attack targeted both IT devices and physical industrial devices, which is unusual.
Targets included:
CERT Polska attributed the attack to Berserk Bear.
ESET attributed the attack to Sandworm with medium confidence.
Dragos Security also attributed the attacks to Sandworm.