Poland institutions and individuals targeted by an unprecedented series of cyber attacks

Poland ‘s government announced that it was targeted by an ‘Unprecedented’ series of cyber attacks, hackers hit against institutions and individuals.

Poland’s parliament had a closed-door session to discuss an unprecedented wave of cyber attacks that hit its institutions and individuals. Mateusz Morawiecki had to provide details about the attacks presenting secret documents related to attacks, as anticipated by government spokesman Piotr Muller.

“Lately we’ve been subject to an unprecedented cyber attack against Poland, against Polish institutions and against individual email account users,” Morawiecki told the Polsat News television channel on Tuesday.

Last week, hackers breached the private email account of Michal Dworczyk, the head of the prime minister’s office and member of the ruling Law and Justice party (PiS). The emails were later leaked through the instant messaging system Telegram. The media reported that the politicians targeted by the hackers used their private Gmail accounts for communications, instead of using their secure government accounts.

“The leaked emails were allegedly stolen through a private account the politician set up on one of the popular Polish portals. The leak is believed to have occurred at the end of last year and many indications suggest Dworczyk had fallen victim to a phishing attack.” reads a post published by the Euractiv website.

“There is no top-secret information in the disclosed emails, but there is no doubt that the head of the prime minister’s office used a private email account for official contacts as email exchanged were found between him and Prime Minister Mateusz Morawiecki, government spokesman Piotr Müller and Development, Labour and Technology Minister Jarosław Gowin.”

According to Muller, the attacks did not target only Dworczyk, hackers also targeted government members, the PiS party, and a large group of people.

Dworczyk pointed out that his email account was not containing secret official documents, he also added that some of the released emails were fabricated, likely by a Russian threat actor.

“The syntax and language of the messages, as well as the metadata of the published files show that this material may have been prepared and compiled by Russian speakers,” Dworczyk said.

Media reported that the metadata of the leaked documents shows that they were edited by a person using Russian-language software. Of course, this is not enough to attribute the attack to a Russia-linked threat actor.

Local authorities and the Internal Security Agency are still investigating the attacks. 

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Poland)

---