Loading story…
Poland said a cyberattack compromised the private email accounts of senior officials, ministers, members of parliament, and journalists, with stolen messages later leaked on Telegram. Authorities said the campaign affected more than 30 people, included the mailbox and social media compromise of Prime Minister’s Office chief Michał Dworczyk and his wife, and was assessed by Poland’s Internal Security Agency, Military Counterintelligence Service, and allied intelligence services as having been conducted from infrastructure in the Russian Federation.
Polish officials described the operation as a broad attempt to destabilize the country, while investigators preserved evidence and notified affected individuals with guidance to secure their accounts. Separate reporting from CERT Polska and SKW tied ongoing Russian espionage activity against NATO and EU diplomatic targets to infrastructure, techniques, and tooling overlapping with NOBELIUM/APT29, including spear-phishing, malicious links, HTML Smuggling, deceptive shortcut files, hidden DLL execution, and DLL sideloading, reinforcing the assessment that the breach fit a wider Russian intelligence collection campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Polish authorities said police officers would start contacting affected and potentially affected individuals that day to inform them about the incident and provide guidance on securing their email accounts. This notification effort accompanied the ongoing investigation.
Deputy Prime Minister Jarosław Kaczyński said leading Polish officials, ministers, and MPs from different parties had been targeted in a broad cyberattack assessed by Polish and allied services as conducted from the territory of the Russian Federation. Authorities said investigative and evidence-preservation actions were underway.
On June 9, Michał Dworczyk, head of the Polish Prime Minister’s Office, said unknown attackers had breached his email account, his wife's mailbox, and their social media accounts. He said Polish state services had been informed and that the compromised mailbox was not used to send information threatening state security.
On the Friday before the report, Poland handed a document describing recent cyberattacks to EU member states, the European Commission, and the Council. An EU diplomat said Polish national cybersecurity incident response teams had linked the infrastructure and modus operandi to Russian-sponsored entities.
Attacks targeting Polish MPs, government officials, and journalists began in September of the previous year, according to reporting cited in the source. The campaign ultimately affected more than 30 people and involved theft of emails later leaked online.
CERT Polska and Poland's Military Counterintelligence Service published a report on an ongoing espionage campaign linked to Russian special services targeting foreign ministries and diplomatic missions, mainly in NATO and EU countries. They said the activity overlapped with NOBELIUM/APT29 but also used previously undocumented malware and tooling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cert.pl
Open sourcegov.pl
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Poland’s Central Bureau for Combating Cybercrime (**CBZC**) arrested a 20-year-old suspected of conducting **global DDoS attacks** against high-profile and strategically important websites. Authorities said the suspect used a multi-layered botnet control architecture involving **C2 “stressers”** and **command-and-control nodes (CNC)**, and seized computer equipment allegedly used to host and distribute DDoS tooling; the suspect reportedly confessed to most charges, was released on bail after a formal statement, and faces up to five years in prison if convicted. Separately, Polish authorities detained a 60-year-old civilian employee in the Ministry of National Defense’s strategy and planning department on suspicion of **espionage** for a foreign intelligence service, with Polish officials indicating links to **Russian and Belarusian** services. Counterintelligence searched the suspect’s office and residence and seized phones, computers, and storage media; prosecutors filed espionage charges while officials cited “extensive evidence” and framed the case as part of broader **hybrid warfare** pressure on Poland, including sabotage, disinformation, and cyber activity attributed to Russia-linked actors.
Jun 29, 2026
Polish officials reported thwarting what they described as the most serious cyberattack on the country’s energy infrastructure in years, saying the intrusion came close to causing a widespread power outage. The attempted disruption occurred in the final days of December and targeted communications links between multiple renewable energy installations—such as **solar farms** and **wind turbines**—and electricity distribution operators across large parts of Poland, in what authorities characterized as a coordinated sabotage effort. Digital Affairs Minister Krzysztof Gawkowski said the incident “very close to a blackout” appeared to be a deliberate attempt to cut power to Polish citizens and that “everything points to Russian sabotage,” though officials did not provide technical details, name a specific threat actor, or disclose the defensive measures implemented afterward. The incident reflects a broader pattern of increased Russia-linked cyber activity against Polish critical infrastructure since Russia’s 2022 invasion of Ukraine, alongside ongoing kinetic strikes on Ukraine’s energy system that Ukrainian authorities have described as creating an “unprecedented” energy crisis.
Jun 29, 2026
The United Kingdom and European Union imposed their first joint cyber sanctions package against Russian state operators, proxy hackers, and influence actors, formally attributing an attempted attack on Poland’s energy grid to Russia’s FSB **Centre 16**. Officials said the failed operation could have cut electricity to as many as **500,000 people** during winter, and linked the same Russian cyber ecosystem to intrusions targeting water treatment facilities, government networks, defense organizations, and other critical infrastructure across Europe. The EU also publicly identified the FSB’s **16th Centre** as controlling several threat groups, including **Turla**, and cited a failed attack on Poland’s critical infrastructure. The sanctions cover **24 individuals and entities**, including GRU leaders **Vyacheslav Stafeyev**, **Ivan Senin**, and **Ivan Kasyanenko**, as well as **IMPULS**, which Western officials said helped GRU Unit 29155 recruit hackers and cyber specialists. The package also targets operators tied to **Lumma Stealer**, which UK authorities said has been used to harvest stolen credentials for espionage and affected at least **2,100 UK victims** in six months, and **10 people linked to Rybar LLC**, accused of supporting pro-Kremlin disinformation and election interference in Moldova and Armenia. France separately announced additional sanctions, released a technical report on Centre 16 activity, and said it would summon the Russian ambassador over ongoing cyber espionage and sabotage.
Jul 29, 2026