A distributed denial-of-service (DDoS) attack allegedly targeted the Civic Platform’s (PO) website on Friday, according to government spokesperson Jan Grabiec. The Prime Minister’s Office and the National Research Institute (NASK) were quick to blame a pro-Russian hacking group. But cybersecurity experts are now raising serious doubts — suggesting the entire incident may have been staged.
At 9:00 AM on Friday, Jan Grabiec posted on social media that the PO’s websites, including its main page and a campaign donation platform, were under DDoS attack and had been temporarily taken offline. He noted that the government was working with CERT NASK (Computer Emergency Response Team) to restore functionality.
Shortly afterward, NASK’s media and communications director Jacek Dziura identified the alleged perpetrators: “What we can confirm is that today’s DDoS attacks on several Polish websites were carried out by the pro-Russian hacktivist group NoName057,” he said.
But the narrative quickly began to unravel. Jakub Krysiewicz, an independent IT expert, challenged the official version with a series of technical observations:
- The servers were never actually offline.
- The PO’s server was still accessible for login.
- The PSL’s server had disabled its HTTP (port 80) and HTTPS (port 443) access, yet email ports remained active — indicating the server was up, just not serving web content.
- The Civic Platform’s site had a configured 302 redirect pointing to a standard 503 service unavailable message.
- After Krysiewicz publicized these details, the redirect was switched to a 200 OK response, but displayed a fake error page instead.
So was there really an attack — or something else entirely?
One tech-savvy commenter on X (formerly Twitter), John Bingham, offered a blunt assessment:
“Let me translate from IT to Polish: This ‘Russian cyberattack’ was either carried out by a 7-year-old or there was no attack at all — just a pathetic attempt by administrators to fake one. There is no third option.”