Cyberattack Poland March 2026
Nuclear reactor, hospital,
government institutions hit.

• Social engineering: Employee opened malicious attachment „Invoice_Service.pdf”
• AiTM (Adversary-in-the-Middle): Script stole session token, bypassing MFA
• Backup sabotage: Attackers accessed backup servers and deleted backups before encryption
• Outcome: Hospital network paralyzed, registration system down, patient care compromised
• Ransom demand: Millions of dollars. Prosecutor’s office investigating.

• Attack vector: Entry points traced to Iran (potential false flag)
• Target: Servers managing Poland’s only nuclear research reactor
• Response: Rapid coordination between NASK, CSIRT MON, Ministry of Energy
• Outcome: Attack thwarted, reactor MARIA continues normal operation

„Thanks to rapid and effective security systems, the attack was thwarted.” – Prof. Jakub Kupecki, Director of NCBJ

• Spear-phishing: Social engineering emails with malicious links
• Redirect chain: run.mocky.io → webhook.site (legitimate, rarely blocked services)
• Why it worked: Using trusted domains reduces detection risk
• Response: CERT Polska (NASK) and CSIRT MON identified campaign

• First wave: Ransomware encrypted systems, stole resident data (names, addresses, PESEL)
• Second wave: One week later, scammers impersonated officials to extort money
• Lesson: Ransomware is just the beginning – identity theft follows

• Vulnerability: Unpatched edge router with Command Injection flaw
• Impact: Disruption of cargo management systems, shipment delays
• Attacker: Likely APT group (Fancy Bear)