Poland Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Poland
Background readingHacktivismIncident response
BRAVO-CRP
The Prime Minister sets one of four CRP cyberspace alert levels by order; Order No. 34 of 25 May 2026 kept BRAVO-CRP in force nationwide from 1 June to 31 August 2026.
Ministry of Digital Affairs and CERT Polska (NASK). Source: Statistics Poland (GUS), Krakow office notice
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
| Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Cyberattacks recorded in Poland | 270,000 | 2025 | The Star (AFP), citing Deputy Digital Affairs Minister Pawel Olszewski |
| Energy facilities hit in the 29 December 2025 campaign | At least 32 | December 2025, reported August 2026 | CERT Polska follow-up report |
| Water treatment stations breached, per ABW report | 5 | 2025, reported May 2026 | The Record |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| UNC1151 (Ghostwriter) | State-aligned | Phishing Polish public figures and Gmail users through 2026, per CERT Polska. | CERT Polska | |
| FSB Center 16 | State-aligned | Named by the EU and UK in July 2026 for the December 2025 attack on Poland's energy grid and attempted sabotage of water facilities. | The Record | |
| Fingerprint | Extortion | Claimed the MyDr, Medyc and Fakturownia breaches in August to October 2026. | The Record | Profile |
Laws and rules this year
- 3 Apr 2026Amendment to the Act on the National Cybersecurity System (KSC). Transposes the EU NIS2 Directive; signed by President Nawrocki on 19 February 2026 and in force from 3 April 2026. Source
Full stories
Official statements
- 8 Aug 2026CERT Polska said the attacker reached a second heat plant's OT network through a misconfigured private APN. CERT Polska
- 13 Jul 2026The EU and UK formally blamed FSB Center 16 for the attack on Poland's energy grid and imposed sanctions. The Record
- 7 May 2026The Internal Security Agency (ABW) reported breaches at five water treatment stations. The Record
- 15 Jan 2026PM Donald Tusk said end-of-2025 attacks on two heat and power plants and renewable sites could not cause a blackout and pointed to Russian services. Polskie Radio
Incidents
5 of 5 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedFakturowniaVia a vendor | 1 Oct 2026 | Other | Data leak | Confirmed. Fakturownia, an invoicing platform used by over 600,000 businesses, confirmed unauthorised server access, and the Finance Ministry said the national e-invoicing system KSeF was not breached. Claimed. Fingerprint claimed to have stolen 6 TB of invoices. | The Record✓ 7 Nov | |
 ✅ ConfirmedMedyc (Qbusoft) medical records platformVia a vendor | 9 Sep 2026 | Health | Data leak | Confirmed. Medyc confirmed theft of patient identity data after an SQL injection, Minister Gawkowski said the cybercrime bureau is investigating, and the data protection authority ordered an audit. Claimed. An actor called Fingerprint claimed records on 5 million patients and 8 million photos. | The Record✓ 7 Nov | |
 ✅ ConfirmedMyDrVia a vendor | 17 Aug 2026 | Health | Data leak | Confirmed. MyDr, a software supplier to clinics, confirmed external criminal access to historical data, and Minister Gawkowski said P1 connection certificates were being replaced as a precaution. Claimed. People claiming responsibility sent alleged samples of patient data to Zaufana Trzecia Strona; the claims are unverified. | The Record✓ 7 Nov | |
 ✅ ConfirmedZabkaVia a vendor | 4 Aug 2026 | Retail | Intrusion | None | Confirmed. Zabka confirmed unauthorised access to technical systems through a third-party provider's account, and Digital Affairs Minister Krzysztof Gawkowski said customer and payment data were not affected. Claimed. Unidentified sellers offered allegedly stolen internal data, including source code and credentials, for 5,000 euros on a cybercrime forum. | The Record✓ 7 Nov |
| ✅ ConfirmedPersonal Gmail users in Poland | 12 Jun 2026 | Other | Not disclosed | Confirmed. CERT Polska reported a high-intensity UNC1151 phishing campaign against Polish Gmail users, active since March 2026. | CERT Polska✓ 7 Nov |
FAQ
What is Poland's national cyber threat level?
BRAVO-CRP. The Prime Minister sets one of four CRP cyberspace alert levels by order; Order No. 34 of 25 May 2026 kept BRAVO-CRP in force nationwide from 1 June to 31 August 2026.
Which organisations in Poland confirmed cyber incidents recently?
5 incidents confirmed since January 2026: Fakturownia, Medyc (Qbusoft) medical records platform, MyDr, Zabka and Personal Gmail users in Poland.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.