Poland — Cyber Threat Profile
Poland's cybersecurity posture is shaped by its NATO frontline positioning and proximity to active geopolitical conflict. National cyber governance is coordinated through the Government Plenipotentiary for Cybersecurity and national CERT structures. Strategic priorities include defense network protection, critical infrastructure security, and counter-espionage operations. Poland faces persistent targeting from state-sponsored actors conducting espionage, disruption, and influence campaigns. Rapid digitalization and military integration increase exposure, while workforce shortages and supply-chain risk remain structural challenges.- National CERT/CSIRT: CERT POLSKA
- Data protection authority: Urząd Ochrony Danych Osobowych (UODO) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 2.22 / 100, #17 worldwide
- Secure Internet servers per 1M people (2024): 41,131.9 (source: World Bank)
- Internet users (2024): 88.6% of population (source: World Bank)
Latest Poland coverage
- Fake PDF alerts on Facebook signed Poles up to paid SMS 2026-09-23 · Cyber Incidents
- T-Mobile 5G router flaws let strangers get root access 2026-09-16 · Vulnerabilities
- Bank's payment plugin lets shop staff rewrite the database 2026-09-14 · Vulnerabilities
- Polish medical software shipped hard-coded API logins 2026-09-10 · Vulnerabilities
- Booby-trapped fonts can crash or hijack Emacs on Android 2026-08-10 · Vulnerabilities
- Hackers reached a power plant through its mobile network 2026-08-09 · Cyber Incidents
Threat actors targeting Poland
- APT28 APT
- FrostyNeighbor APT
- Winter Vivern APT
- The Gentlemen Ransomware · 17 incident(s)
- Qilin Ransomware · 9 incident(s)
- Deadlock Ransomware · 7 incident(s)
- RansomHub Ransomware · 7 incident(s)
- Akira Ransomware · 5 incident(s)
- LockBit Ransomware · 5 incident(s)
- Cl0p Ransomware · 4 incident(s)
- Hunters International Ransomware · 3 incident(s)
- Nova Ransomware · 3 incident(s)
- Coinbase Cartel Ransomware · 2 incident(s)
- INC Ransom Ransomware · 2 incident(s)
- KillSec Ransomware · 2 incident(s)
- NightSpire Ransomware · 2 incident(s)
- Play Ransomware Ransomware · 2 incident(s)
- Rhysida Ransomware · 2 incident(s)
- 8Base Ransomware · 1 incident(s)
- AiLock Ransomware · 1 incident(s)
- APT73 Ransomware · 1 incident(s)
- Black Basta Ransomware · 1 incident(s)
- Cactus Ransomware · 1 incident(s)
- DragonForce Ransomware · 1 incident(s)
- FunkSec Ransomware · 1 incident(s)
- Interlock Ransomware · 1 incident(s)
- Lynx Ransomware Ransomware · 1 incident(s)
- M3rx Ransomware · 1 incident(s)
- Majinahanashi Ransomware · 1 incident(s)
- SafePay Ransomware · 1 incident(s)
- Space Bears Ransomware · 1 incident(s)
- Stormous Hacktivist · 1 incident(s)
- APT29 APT
- Dragonfly APT
- Gamaredon Group APT
- NoName057(16) Hacktivist
- Sandworm Team APT
Most targeted sectors
- Manufacturing 20 incident(s)
- Technology 14 incident(s)
- Business & Professional Services 13 incident(s)
- Retail & Consumer 6 incident(s)
- Education & Research 5 incident(s)
- Government & Public Sector 5 incident(s)
- Healthcare 5 incident(s)
- Transportation & Logistics 4 incident(s)
- Agriculture & Food 3 incident(s)
- Financial Services 3 incident(s)
- Construction 2 incident(s)
- Entertainment & Media 1 incident(s)
Recent claimed incidents
- nowaszkola.com 2026-10-15 · Education
- ETICOD 2026-10-10
- intense.pl 2026-09-29 · Technology
- Zdrowit 2026-09-05 · Healthcare
- LOG Systems 2026-08-21 · Technology
- GB Group S.A 2026-08-13 · Financial Services
- Ponti 2026-08-07 · Other
- Mera Metal 2026-08-05 · Manufacturing
- Bater 2026-07-31 · Other
- Paula Fish 2026-07-31 · Other
- BioResearch 2026-07-25 · Healthcare
- Raben Group 2026-07-23 · Transportation
- Agapit 2026-07-23 · Other
- Lsn 2026-07-16
- Techpol-System 2026-07-13 · Technology