Operators of private cellular networks for industrial sites should check their APN configuration now: Poland’s CERT has disclosed an attack that reached a combined heat and power plant’s control systems through the kind of permissive setup it says is common across the industry.
The December 2025 incident, revealed August 8 after a three-month investigation, ended with a steam turbine and the process-water treatment system shut down. Around 50,000 residents depend on the plant for heat, and restoration efforts started near 7:30 a.m. even as the intruders remained inside the network. Customers lost neither heat nor electricity.
Defenders’ first move, CERT says, is to audit private APN configurations and enable client isolation, treat the APN as untrusted from the OT side, and change default credentials. Default admin credentials were still active on the plant’s WAGO controller, and the private APN allowed client-to-client traffic.
The route in: the attack began at a wind farm, where intruders hit a Fortinet VPN and firewall device exposed to the internet, then found a Teltonika cellular router, used SSH to build a tunnel, reached the private APN, and pivoted toward the plant’s OT network. After roughly a week of reconnaissance, they connected to Siemens PLCs, switched them to stop mode, and set a password that blocked operators from changing the controllers’ state and control logic. They also damaged the WAGO controller by corrupting its partition table, and a factory reset failed to repair it.
As far as CERT knows, this is the first real-world attack to reach an industrial control network through a private APN. No CVE has been established as the cause, and the report warns similar permissive configurations are widely deployed in other countries.
