Poland's Internal Security Agency revealed in a Friday report covering the past two years of operations that hackers successfully penetrated five water treatment plants and came close enough to taking control of industrial equipment that, in the worst case, could have allowed them to tamper with the safety of the water supply. The agency did not explicitly attribute the water infrastructure attacks to Russian government hackers, but the broader report made clear that Russian intelligence services have been behind a sustained and escalating campaign of sabotage against Polish military facilities, critical infrastructure, and civilian targets — attacks the agency described as "real and immediate" and potentially capable of causing fatalities. Poland has already faced a confirmed attempt by Russian government hackers to bring down its energy grid earlier this year, later attributed in part to poor security controls at the targeted facilities. The pattern fits a deliberate Russian strategy, according to Polish intelligence, of destabilizing and weakening Western countries through a combination of cyberespionage, physical sabotage, and infrastructure attacks that mirror tactics already deployed extensively in Ukraine.

The relevance of Poland's experience extends well beyond its borders, and the US in particular has faced nearly identical threats against the same category of infrastructure. In 2021, a hacker gained access to a water treatment plant in Oldsmar, Florida and attempted to raise sodium hydroxide levels to dangerous concentrations before the attempt was caught and reversed. More recently, just last month, a joint advisory from the FBI, the NSA, CISA, and several other federal agencies warned that Iranian-backed hacking group CyberAv3ngers is actively targeting programmable logic controllers — the industrial computers that run water and energy facilities — at US utilities. The same group previously broke into digital control panels at multiple Pennsylvania water treatment plants in 2023. Water infrastructure represents one of the softest targets in critical infrastructure security: facilities are often under-resourced, running legacy industrial control systems that were never designed with network security in mind, and managing them with small teams that lack dedicated cybersecurity expertise. The attacks against Poland are not an anomaly — they are part of a coordinated global strategy by state-backed actors who have identified water and energy infrastructure as high-impact, relatively low-difficulty targets in an era where hybrid warfare increasingly plays out through industrial control systems rather than conventional military engagement alone.Sonnet 4.6