The Polish Space Agency (POLSA) recently experienced a cybersecurity breach, prompting the organization to disconnect its IT infrastructure from the internet. POLSA confirmed the incident through a post on X, stating that relevant authorities had been notified.

“There has been a cybersecurity incident at POLSA,” the machine-translated X post reads. “The relevant services and institutions have been informed. The situation is being analyzed. In order to secure data after the hack, the POLSA network was immediately disconnected from the Internet. We will keep you updated.”

The brief statement led to speculation about the nature of the attack, with some reports suggesting it could be a ransomware incident. Typically, organizations hit by ransomware isolate their systems to prevent further damage and block unauthorized access.

An anonymous source disclosed to The Register that POLSA’s email systems had been compromised. As a precaution, employees were instructed to switch to phone-based communication instead of email.

Poland’s digitalization minister, Krzysztof Gawkowski, later confirmed the breach, stating that the government had launched "intensive operational activities" to identify the perpetrators. He also noted that POLSA was receiving support from the country’s cybersecurity teams, CSIRT NASK and CSIRT MON.

At this stage, the attackers' identities and motives remain unclear. However, Reuters reports that Warsaw has “repeatedly” accused Moscow of attempts to destabilize Poland, particularly due to its military assistance to Ukraine amid the ongoing conflict.