CERT Polska says a December 29 attack on a Polish combined heat and power plant was the first observed case of attackers reaching an operational technology network through a private APN, after tracing the path from renewable energy sites into the plant. The incident shut down a steam turbine and the water treatment system that produced process water, though operators restored the plant before heat or electricity customers were affected.
A private APN is meant to be a dedicated mobile network separating industrial devices from other traffic, but here that same carrier-backed link appears to have connected sites in a way that let access move from one energy asset to another. In plain terms, the network boundary behaved less like a fence and more like a shared corridor.
For operators tying renewable assets back to central CHP or other OT environments, the connection itself is part of the attack surface. If that mobile path is assumed to be isolation, a compromise at one site can turn into access to turbines, treatment systems, or other plant controls at another.