Elephantfly

In late December 2025, a Russian hacking group called Sandworm attacked over 30 wind and solar farms across Poland. Poland called it the largest cyber attack on its power grid to date.

How did they get in? In many cases, through default usernames and passwords that had never been changed.

A separate study across more than 100 energy systems worldwide found the same pattern: basic security gaps that have been known about for years, still sitting wide open.

This is not a story about nation-state warfare being irrelevant to Irish business. It is a story about how attacks on critical infrastructure spread outward — through supply chains, shared networks and interconnected systems.

For any Irish business that runs industrial controls, relies on utility providers or has operational technology on site, two questions are worth asking this week.

When did you last audit default credentials across your systems? When did you last review who has access to what — and why?

Those are not glamorous questions. But they are the ones that matter right now.

A security review is something we support at Elephantfly. Feel free to get in touch if you would like to discuss where to start.

An AI agent is not a chatbot. It is a system that takes action on your behalf — across multiple steps — without you in the loop every time.

Insurance companies are already using this for claims processing. The question for Irish SMEs is not whether this matters, but which of your processes could benefit. The ones that start testing now will have a meaningful head start.

Drop a comment if you want to know where to begin.