A Polish power plant was compromised via a private APN — the first documented OT attack using mobile lateral movement

Poland's CERT revealed on August 10, 2026 that a threat actor used a misconfigured private APN to compromise a combined heat-and-power plant serving 50,000 residents. This is the first documented OT attack using an APN as a lateral movement vector.