WARSAW, Poland (AP) — Poland experienced 2½ times more cyberattacks in 2025 compared to the previous year, and the numbers are constantly rising, a government official said Tuesday.
The attacks included a destructive infiltration of the country's energy system in December that was believed to be unprecedented among NATO and European Union members, and was suspected of originating in Russia.
Over the last year, Poland was the target of 270,000 cyberattacks, Deputy Minister of Digital Affairs Paweł Olszewski said Tuesday.
“We've been waging a war in cyberspace for many years now,” the official said. “The number of incidents and attacks has been increasing significantly and radically year after year.”
The government, led by Prime Minister Donald Tusk, has beefed up its cyber defenses since the start of Russia's full-scale invasion of Ukraine on Feb. 24, 2022, in response to what it believes to be a rising threat from Russia.
During the morning and afternoon of Dec. 29, coordinated cyberattacks hit a combined heat and power plant supplying heat to almost 500,000 customers, as well as multiple wind and solar farms in Poland.
Polish authorities suspected the cyberattacks were done by a single “threat actor,” with multiple experts pointing to culprits linked to Russian secret services.
The electricity supply wasn’t disrupted, but the nature of the sabotage alarmed Polish authorities so much that the agency CERT Polska, or Computer Emergency Response Team Poland, issued a public report in late January on technical details of the incident and asked the cyber community for any input on what happened.
“The attack was a significant escalation,” CERT head Marcin Dudek told The Associated Press.
“We’ve had such incidents in the past, but they were of the ransomware type, where the motivation of the attacker is financial," Dudek said. “In this case, there was no financial motivation — the motivation was just destruction.”
He said that Poland has seen only a few destructive incidents in the past and none of them were in the energy sector.
Dudek said that he wasn't aware of any other destructive cyberattacks on the energy sector in either NATO or EU countries. There have been espionage incidents and activist groups causing marginal damage, but “advanced attacks” like the December one in Poland are likely unprecedented, he said.
Had it targeted even larger energy units, it could have substantially impacted the stability of Poland's energy grid, Dudek said.
The Polish secret services haven't yet publicly identified an alleged culprit.
Dudek's team is authorized only to describe the modus operandi and point to a likely “threat actor” — cyber jargon for an individual or group engaging in malicious activity.
The CERT analysis looked at the Internet infrastructure used in the Polish attack, including domains and IP addresses, and found that they had been used previously by a Russian threat actor known as “Dragonfly,” and also called “Static Tundra” or “Berserk Bear.”
Dudek said Dragonfly has been known to target the energy sector, but so far not with a destructive attack.
According to an alert issued by the FBI in the United States in August 2025, Dragonfly is a cybersecurity cluster associated with FSB Center 16, a key unit within Russia’s Federal Security Service.
Experts unrelated to Polish authorities agree that the traces of the December attack lead back to Russia.
ESET, one of the largest cybersecurity companies in the EU, analyzed the malware used in the attack and concluded the culprit likely was “Sandworm,” another possible Russian actor previously associated with destructive attacks in Ukraine.
The U.S. government has in the past attributed Sandworm to the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation, or GRU.
Anton Cherepanov, senior malware researcher at ESET, told The Associated Press that “the use of data-wiping malware and its deployment” in the Polish case “are both techniques commonly employed by Sandworm.”
“We are not aware of any other recently active threat actors that have used data-wiping malware in their operations against targets in European Union countries,” Cherepanov added.
Whether Dragonfly or Sandworm, it would an actor previously affiliated with Russia. “Whether it’s these Russians or those Russians is a detail,” Cherepanov said.
The Russian Embassy in Warsaw didn't respond to requests for comment.
FILE - Poland's Prime Minister Donald Tusk speaks with the media as he arrives for the EU summit in Brussels, Jan. 22, 2026. (AP Photo/Geert Vanden Wijngaert, File)
WASHINGTON (AP) — Senators raced Tuesday to clinch an emerging proposal to end the Homeland Security shutdown by funding much of the department, including the Transportation Security Administration airport workers going without pay, but excluding ICE enforcement operations that have been core to the dispute.
The sudden sense of urgency comes as U.S. airports are snarled by long security lines, with travelers being told to arrive hours before their flights in Houston, Atlanta and Baltimore Washington International. Routine Homeland Security funding was halted in mid-February ahead of the busy spring travel season. Nearly 11% of TSA workers — more than 3,200 — missed work Monday, and at least 458 have have quit altogether since the shutdown began, according to DHS.
Democrats are refusing to fund the department without restraints on Trump’s immigration and deportation agenda after agents killed two citizens in Minneapolis.
A potential breakthrough came late Monday, after a group of Republican senators met at the White House with President Donald Trump after his decision to deploy federal immigration officers at some airport security checkpoints — a move some lawmakers warned could lead to heightened tensions.
“All I can say is that the discussions have been very positive and productive, and hopefully headed in the right direction,” said Senate Majority Leader John Thune, R-S.D., late Monday evening.
Senate Democratic Leader Chuck Schumer sounded a similarly hopeful tone: “Both sides are working in a serious way.”
Next steps in Congress could move quickly, if lawmakers can reach a deal, or sputter out just as fast.
The contours of the deal under consideration would fund most of Homeland Security, but not one main part of ICE — the enforcement and removal operations that are core to Trump's deportation agenda.
Under the proposal being floated, ICE's Homeland Security Investigations would be funded as well as Customs and Border Protection. But that would come with guardrails — keeping officers from those divisions in their traditional roles, rather than deploying them in urban immigration roundups.
The plan would also include a number of changes in immigration operations that Democrats have demanded, including mandating that officers wear body cameras and identification. The ICE officers manning airports are already going without face-covering masks, another key demand Democrats want as part of any deal.
Since so much of ICE is already funded through Trump's big tax breaks bill, and immigration officers are still receiving paychecks despite the shutdown, senators said the new restraints would also be imposed on operations that rely on that funding source, as well.
Republican Sen. Katie Britt of Alabama, a chief negotiator, returned from the White House meeting hopeful they had a solution to “land this plane.”
Both chambers of Congress are controlled by the Republican president's party, and any deal reached in the Senate would also have to be approved by the House.
Key to the standoff appears to have been the senators' ability to shift the president's attention off his plan to link any department funding to his push to pass the so-called SAVE America Act, a strict proof-of-citizenship and voter ID bill that has stalled in the Senate ahead of the midterm elections.
Over the weekend Trump injected his demand for the voting bill as a condition for ending the funding standoff. Some GOP senators have pitched the idea of tackling it in the months ahead as part of a broader legislative package the party could pass on its own, similar to last year's big tax cuts bill.
Sen. Chris Coons, D-Del., who was not part of the group at the White House, said his understanding was that there was a “sense of urgency” coming from the talks as the airport disruptions worsen.
Senators are expected to discuss the proposals during their private caucus lunches Tuesday afternoon. “First step is to get the proposal in writing,” said Sen. Angus King, an Independent from Maine. “I want to see exactly what that means.”
The deal could provide a political exit from the standoff over the embattled Homeland Security department, which was stood up in the aftermath of the Sept. 11, 2001 attacks but has come to symbolize Trump’s aggressive mass deportation agenda, with its goal of removing 1 million immigrants this year.
Under mounting political pressure, Trump ousted Homeland Security secretary Kristi Noem amid the public outcry over the immigration operations, and senators late Monday confirmed one of their own, Markwayne Mullin, as the president's handpicked replacement.
Mullin, an Oklahoma senator who aligns with Trump's agenda, provides a potentially new face for the department. During his confirmation hearing, Mullin touched on another key demand of Democrats — ensuring a judge has signed off on warrants that immigration officers use to search people's homes, rather than simply relying on administrative warrants issued by the department.
“This is significant,” Sen. Peter Welch, D-Vt., said about the progress toward changes. "Noem is gone. That’s a big deal.”
ICE’s budget nearly tripled under last year’s bill, to $75 billion, which has been untouched by the shutdown. Rather its routine annual funding, some $10 billion, would be cut almost in half under the proposal.
After weeks of missed paychecks, many TSA agents have called in sick or even quit their jobs as financial strains pile up. Union leaders representing the workers have pushed Congress to reach a deal.
Associated Press writers Rio Yamat, Wyatte Grantham-Philips, Kevin Freking and Seung Min Kim contributed to this report.
People wait in a TSA line at the Hartsfield-Jackson Atlanta International Airport, Monday, March 23, 2026, in Atlanta. (AP Photo/Mike Stewart)
Senate Majority Leader John Thune, R-S.D., talks to reporters about a funding bill to end the shutdown of the Department of Homeland Security shutdown that began more than a month ago, at the Capitol in Washington, Monday, March 23, 2026. (AP Photo/J. Scott Applewhite)
