Learning Polish Lessons From Russian Attacks

Poland’s battle against cyberattacks should be a warning and an example for the West as governments seek to counter their enemies’ hybrid tactics.

Source: Embassy of the Republic of Poland in London

A hospital was forced to suspend operations. A city’s water network was infiltrated. Dozens of daily cyberattacks are hammering Poland’s municipal systems.  

This is the new normal in an era of irregular warfare. Officials report 20 to 50 attacks a day, with most blocked, but some succeeding. Each disruption is more than a nuisance — it’s a strike at public trust and security.  

Persistent cyberattacks on Poland’s critical infrastructure threaten a long-term erosion of utilities and government credibility. However, they can also serve as a catalyst: A chance to strengthen networks, train recovery teams, and transform vulnerability into resilience. 

Credibility is a fragile resource. When a hospital shutters its systems for hours or patients’ records leak online, confidence is diminished. When a city’s water supply is nearly cut off, the fear lingers long after the pipes fill again.  

Each near miss is a warning shot, and adversaries know they don’t need to collapse the system; they just need to keep hitting, chipping away at stability, and undermining citizens’ faith. Persistent degradation works like erosion. Small cracks become fault lines, and trust, once shaken, rarely returns intact. 

Poland is pouring money into defense against the attacks. A record €1bn ($1.17bn) cybersecurity budget is set for 2025, with special focus on water infrastructure. But money alone does not buy resilience.  

Municipal utilities often run on aging software and short staffing. And attackers know it. The solution is not simply higher walls but deeper roots — building redundant systems, holding routine disaster drills, and practicing recovery plans.  

NATO doctrine emphasizes continuity of mission, not perfect defense. Poland’s challenge is the same: build a network that bends, absorbs the hit, and snaps back fast. 

Some take comfort in the numbers and the success (see above) in blocking almost all daily attacks. But the “almost” is the problem. A single breach of a hospital, a power station, or a water utility can outweigh dozens that are thwarted.  

Every failed attempt is also reconnaissance, mapping weaknesses for the next strike. To claim victory because most attacks bounce off is like boasting the dam holds while ignoring the cracks. The true measure is whether Poland treats each attack as a stress test rather than a sigh of relief. 

Poland is the frontline. It hosts NATO forces, channels aid to Ukraine, and stands squarely in Russia’s sights. Cyberattacks on its hospitals and utilities have ripple effects that extend beyond its borders.  

While a weakened Poland undercuts NATO credibility and emboldens adversaries, a resilient Poland can set the standard for Europe.  

The question is whether Warsaw uses this moment to act, by building fallback and backup systems for key assets at the municipal level, or funding not just firewalls but recovery playbooks. By treating every disruption as a drill for the next one.  

Allies should care because the stakes are not only high for Poland, they are transatlantic. If Poland falters, others will follow. If it adapts, others will learn. 

Persistent attacks can erode trust, leaving utilities vulnerable and citizens skeptical, or they can forge a new model of resilience where networks withstand blows, recover quickly, and prove harder to break next time.  

For Poland, these attacks are a test, and for Europe, they are a warning. A hospital outage in Warsaw or a water scare in Kraków today could be Paris or Berlin tomorrow. The line between nuisance and crisis is thin, and Poland can close the gap, by demonstrating that resilience, not fragility, defines Europe’s cyber future. 

---

By Emily Otto. Emily Otto is a non-resident fellow at CEPA. She is an Alperovitch PhD Fellow at Johns Hopkins School of Advanced International Article first time published on CEPA web page. Prepared for publication by volunteers from the Res Publica - The Center for Civil Resistance.