Cyberattack on the Polish Press Agency: Lessons and Protection

Cyberattack on the Polish Press Agency: Lessons and Protection

The District Prosecutor’s Office in Warsaw conducted an investigation into the cyberattack on the Polish Press Agency (PAP) that took place on May 31, 2023. False information appeared twice on the PAP website. Cybercriminals gained access to an employee’s account and posted a fabricated dispatch. Although it is not yet known how the criminals infiltrated PAP’s systems, similar incidents can be prevented in the future.

The Global Risks 2024 report prepared by the World Economic Forum showed that disinformation was one of the greatest global threats. Research by the “Together Against Disinformation” Coalition indicated that 81% of Poles believed that the scale of online disinformation had increased over the past decade. These findings were published in the report “Disinformation Through the Eyes of Poles.”

False information is spread in various ways, including through social media and credible news channels. The PAP incident exemplifies how cybercriminals can sometimes publish false data through direct actions.

It is likely that the PAP employee’s account was compromised through malicious software. It remains unclear whether the attacker stole credentials or session data – explained Bartosz Cieszewski, Solution Architect at Secfense, a cybersecurity company. In the first scenario, hackers use stolen credentials to log into various services and perform actions such as posting false dispatches. In the second scenario, the attacker hijacks an existing session, gaining access without needing to log in.

Can We Prevent Such Attacks?

Strong authentication mechanisms are effective against stolen credentials, while session hijacking can be prevented through microauthorizations.

Username and Password are Not Enough

Data from Cisco Talos Incident Response showed that in 2023, a quarter of security incidents involved compromised user accounts. Cybercriminals obtain credentials through phishing, which involves impersonating trusted institutions to steal confidential information.

  • Two- or multi-factor authentication mechanisms protect against the use of stolen credentials. Losing a username and password is not sufficient to gain access to a service or application. Passkeys technology further protects against phishing, eliminating the need for easily compromised passwords – explained Bartosz Cieszewski from Secfense.

Dangerous Cookies

Multi-factor authentication does not protect against session hijacking. This attack involves taking control of an active user session. The attacker gains access to resources and data that the legitimate user is authorized to access without needing login credentials.

  • Session information is stored in cookies, HTTP headers, or session variables. Attackers target the unique session identifier to take control. Micro-authorizations protect against such attacks – said Bartosz Cieszewski.

Micro-Authorizations – Protection Against Session Hijacking

Micro-authorizations require re-authentication each time a user attempts to access specific resources or perform certain actions. They can be implemented anywhere in an application, with the owner or administrator deciding which actions need extra protection. FIDO2 authentication mechanisms, such as biometric identity confirmation, are easy to use and effectively prevent unauthorized access.

  • In the PAP case, micro-authorization for the “add dispatch” action would have thwarted the attacker’s plans. Even with a hijacked session, the hacker would have been prompted for 2FA when trying to publish – added the expert from Secfense.

Disinformation is becoming an increasing problem. Media organizations should pay close attention not only to the accuracy of published information but also to adequately protect their systems against cybercriminals.

Antoni takes care of all the marketing content that comes from Secfense. Read More


We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk



We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director


Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera


Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures

Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.

Dariusz Pitala

Head of IT