Incident Response

Hacking Attempt Reported at Poland’s Nuclear Research Center

Initial evidence indicates Iran may be behind the attack, but officials admitted it could be a false flag. 

Poland nuclear cyberattack

Poland’s national nuclear research center was recently targeted in a cyberattack that may have been conducted by Iranian hackers.

The National Centre for Nuclear Research (NCBJ) is Poland’s largest research institute focused on nuclear science and technology. It operates the country’s only nuclear research reactor, MARIA, and conducts research in nuclear and particle physics, reactor technology, radiopharmaceuticals for medical applications, and industrial and environmental applications.

NCBJ also supports Poland’s civilian nuclear power program, but it does not conduct any military-related activities. Poland does not have a nuclear weapons program.

[ Read: Iranian Hacker Attack on Stryker Disrupted Manufacturing and Shipping ]

In a statement issued last week, the NCBJ said its IT infrastructure was recently targeted by hackers, but the attempt was thwarted and systems have not been compromised.

“There was no disruption to any production, operational or research processes, and the MARIA reactor works safely and without interference, with full power,” reads a translation of a statement from Jakub Kupecki, the nuclear center’s director.

Advertisement. Scroll to continue reading.

Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski told news broadcaster TVN24+ that early indicators suggest Iran as the source of the hacking attempt. He cautioned, however, that the evidence might have been planted to mislead investigators and obscure the true origin.

The attack on Poland’s nuclear research center comes roughly two months after a threat actor targeted the country’s power grid.

The power grid attack, attributed to a Russian group, did not result in any electrical outages, but did lead to permanent damage to some industrial control systems (ICS).

Related: US Cyber Strategy Targets Adversaries, Critical Infrastructure, and Emerging Technologies

Related: 3 Threat Groups Started Targeting ICS/OT in 2025: Dragos

Related: US Braces for Cyberattacks After Bombing Iranian Nuclear Sites

Related Content

Malware & Threats

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.

Cybercrime

Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad.

Malware & Threats

US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.

ICS/OT

The attack caused real-world operational disruption and raised concerns about the resilience of Britain’s distributed energy infrastructure and the potential for repeatable attacks.

Cyberwarfare

The 17 members of the Mabna Institute targeted hundreds of universities and organizations in the US and abroad.

ICS/OT

CERT.PL said this appears to be the first instance of a private APN being used as an attack vector.

ICS/OT

Georgia has been confirmed as one of the attacked states after Clayton County reported a pump station disruption.

ICS/OT

Michigan, South Dakota, and Georgia are reportedly on the list of states whose water systems have been targeted by Iran-linked hackers.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version