By Itay Glick Energy sector cybersecurity focuses on nation-state threats, but breaches stem from basic failures like default credentials and weak OT controls. On 29 December 2025, coordinated attacks struck more than 30 energy facilities across Poland in the middle of winter. A detailed report by CERT Polska revealed that whilst the state-backed attacker was a sophisticated outfit, the vulnerabilities they exploited were anything but. What lessons should be taken from the CERT Polska report? The scale and destructive intent behind the attacks in Poland should have everyone paying attention. Simultaneous strikes across more than 30 renewable energy installations, a manufacturing company, and a major heat supplier required a high degree of coordination. At the same time, every action was designed to disrupt and destroy, with no ransom demand and no financial motive. CERT Polska’s forensic analysis attributed the attack infrastructure to a Russian state-backed cluster with a long history of targeting energy sector entities. However, I think the biggest learning point is actually the fundamental security flaws the group used to gain system access. Every affected facility was accessed through FortiGate devices acting as VPN gateways. They were exposed to the internet, with no multi-factor authentication in place and static credentials that had never been rotated. These weren’t zero-days or novel techniques but known weaknesses that had simply never been addressed. Another detail that stands out is that, in every instance where non-default credentials were properly configured, the attack failed. This is an extremely basic part of cyber hygiene, but it was enough to deflect a well-resourced, state-sponsored actor. Why do basic security failures remain the most significant risk for energy companies? Most sectors struggle with the fundamentals, but these flaws are especially prevalent in areas like energy which rely on operational technology (OT). The hardware in these environments