Why Is Poland the Second Most Cyberattacked Country in the World?

A Digital State of Emergency: Poland on the Cyberattack Podium

If you follow cybersecurity news as closely as the weather forecast, ESET's latest reports may have sent a serious chill down your spine. The global "ESET Threat Report" is clear: Poland is a prime target for cybercriminals and holds the unenviable position of second in the world for the number of attacks. That's not a typo. At the same time, a second and equally important report, "Cyberportret polskiego biznesu 2025" (Cyber Portrait of Polish Business 2025), prepared by ESET and DAGMA Bezpieczeństwo IT, shows in unsparing detail why this is happening. The gap between what Polish companies say they know and what they actually do is alarmingly wide.

Over the past twelve months, nearly half of Polish companies (48%) saw more attacks, and almost as many (46%) noticed attacks becoming much more varied. In practice, this means businesses are dealing with increasingly complex attack scenarios that require both better technology and faster response.

October, observed as European Cybersecurity Month (ECSM), is the perfect moment to look at what's really happening behind our screens. This year's 13th edition, run in Poland under the patronage of NASK (Poland's National Research Institute), focuses on people and the growing role of artificial intelligence in attacks. It's time to take off the rose-colored glasses and see what the real battlefield looks like.

The Human Factor: Our Weakest Link

Even the best security systems are useless if employees' everyday habits let them down. This is where the "Cyber Portrait of Polish Business" report exposes the biggest weaknesses.

• Terrible password habits: A full 55% of employees reuse the same passwords across different work accounts and devices. It's like using one key for your house, your car and your office: lose it, and everything is compromised.
• No training: This may be the most alarming finding: more than half of employees (55%) haven't attended a single cybersecurity training session in the past five years. The report's authors call this result "dismal," and it's hard to disagree.
• Fear of reporting: Worryingly, 17% of employees who experienced a cyberattack at work didn't tell anyone. That kind of silence can let an incident spread unchecked across the entire company.

On top of that, there's a powerful new threat: artificial intelligence. Awareness of it is minimal. As many as 58% of employees have never heard the term "deepfake," and only 28% (IT experts included!) have taken training on AI-related threats. The result? Nearly one in five employees (19%) admitted to sharing sensitive data with AI tools such as ChatGPT, including financial information and confidential customer data.

DDoS, or a Flood of Packets: When Your Toaster Attacks Servers

Imagine thousands of your devices, from your fridge to your router to your security camera, suddenly sending junk data to a single place on the internet. That's the essence of a DDoS (Distributed Denial of Service) attack, which aims to cripple the victim's server by flooding it with traffic.

FastNetMon recently reported stopping one of the largest attacks of this kind ever seen in Europe. At its peak, it reached 1.5 billion packets per second (1.5 Gpps). This digital tsunami came from thousands of infected IoT devices and popular MikroTik routers spread across more than 11,000 networks worldwide. And the target? A company that specializes in... DDoS protection. It's like trying to ram a tank factory with a tank.

Pavel Odintsov, founder of FastNetMon, warns that the mass use of consumer hardware to carry out attacks is a growing threat. Unfortunately, many Polish homes and businesses are unknowingly part of these global botnet armies. DDoS attacks keep getting more powerful: CERT Orange Polska reported a record-breaking attack in May 2025 that exceeded 1.3 Tb/s.

Stores Under Fire: Ransomware and Security Flaws

Poland is also a major target for ransomware. Particularly concerning is that more than half of the experts surveyed (54%) expect these attacks to become much more frequent in the near future.

But ransomware isn't the only threat facing e-commerce. Adobe recently issued a warning about a critical vulnerability in Adobe Commerce and Magento Open Source. The flaw, dubbed "SessionReaper" (CVE-2025-54236), received a CVSS score of 9.1/10, making it a digital time bomb. An input validation error allows attackers to take over store customers' accounts. To learn how flaws like this work, read our guide to zero-day vulnerabilities.

Sansec, a company specializing in e-commerce security, rated "SessionReaper" as one of the most serious vulnerabilities in Magento's history. It shows how thin the line is between a successful sale and a complete compromise of customer data.

The Never-Ending Story: A Flood of Vulnerabilities vs. Reality

For IT administrators, the second Tuesday of every month is "Patch Tuesday," the day Microsoft releases its security updates. September was no exception, bringing a real wave of critical flaws. This constant arms race shows that there's no such thing as a secure system, only systems that are patched and systems that are about to be attacked.

So how is Poland responding to these threats? Poorly, unfortunately. Instead of building digital fortresses, we often put up fences made of twigs.

• Only 53% of companies use antivirus software. That means almost half of businesses operate without basic protection.
• Multi-factor authentication (MFA), one of the simplest and most effective safeguards, is used by fewer than 25% of companies.

This shows that even the most basic protections are underused in Poland. Fortunately, there's a glimmer of hope: cybersecurity is one of the few areas where companies aren't planning budget cuts. Most are maintaining or increasing spending and treating it as a strategic priority.

From Digital Attack to Physical Blackout and Legal Chaos

The line between the digital and physical worlds is increasingly blurred. A case in point is a recent incident in Berlin, where an anarchist group set fire to high-voltage pylons and cut power to more than 50,000 customers. This physical attack on critical infrastructure shows what could happen if control systems become the target. The same problem applies to the cloud in strategic sectors.

Meanwhile, there's chaos on the legislative front. The EU's NIS2 Directive was meant to expand the range of organizations required to implement security standards. The reality? More than a third of IT decision-makers (36%) aren't sure whether their company is even covered by the new regulations, which raises questions about how effectively they're being implemented and communicated. In an unstable geopolitical climate, digital sovereignty is also becoming more important. Nearly six in ten specialists (59%) prefer European technology vendors, and half of companies see dependence on non-European software as a potential threat.

Time to Act

The "Cyber Portrait of Polish Business 2025" report paints a picture of companies that increasingly understand how important cybersecurity is but still struggle with significant gaps, from employees' everyday habits to inadequate training to underuse of basic security tools. Digital security isn't a matter of a single action or a single department. It's an interconnected system in which a weakness in one element can undo the effort invested in all the others.

European Cybersecurity Month is a great opportunity to raise your guard. Update your software. Turn on multi-factor authentication. Don't click suspicious links. And above all, invest in regular employee training. Because in this game, the question isn't whether we'll be attacked, but when. How well prepared we are determines whether it ends as a minor incident or a digital disaster.

Sources:

• ESET Threat Report H2 2024
• Poland the World's Most Frequent Ransomware Target in 2025
• Cybersecurity of Polish Companies in a New Reality: Second Edition of the ESET and DAGMA Bezpieczeństwo IT Report
• Cyber Portrait of Polish Business Report
• European Cybersecurity Month - NASK
• DDoS Attacks in Poland - Business Insider
• Statistics and Threats to Critical Infrastructure in Poland

Read also about Russian cyberattacks on Poland, attacks on Poland's energy sector and the elite APT28 group, which is behind many operations against Poland. You can also learn more about the NIS2 Directive and its requirements.

Aleksander