04 Seven Doors Into the Energy Operation

Five of these doors were open in Poland. All seven are open somewhere today.

1. The forgotten cellular router. The attacker reached a cellular router at the wind farm after the firewall fell. Its default password had been changed. It still became the bridge to the private network. One good fix is a start, never the finish.

2. The private network no one inventories. The grid operator's private APN let devices on it reach each other. That single setting turned a wind-farm breach into a power-plant breach.

3. The vendor connection that never closes. Remote access set up for one repair often stays open for years. Every always-on link is a road someone else can drive.

4. The exposed management interface. The doorway controller at the plant showed its admin page to anyone on the private network. That page let the attacker turn on remote login.

5. The flat path from renewables to plant controls. Nothing stopped traffic from a wind farm from reaching a heat-and-power plant's controller. Two sites, two owners, one shared path.

6. The device with default or shared credentials. The doorway controller still used its factory password. Every week of the attack rested on that one login.

7. The fix nobody checked. After a change, teams often confirm the system works and move on. Nobody checks whether the risky path is actually gone, or whether it quietly came back.