Polish train maker sues hackers and repair shop after anti-repair software was exposed
Mar 1st 2026
Newag has sued repair shop SPS and members of hacking group Dragon Sector after those researchers revealed software that disabled trains to block independent repairs, with lawsuits in two courts seeking more than $3 million.
- Hackers from Dragon Sector and repair shop SPS exposed software in 2022 that could disable Newag trains to prevent third party repairs.
- The lockout used time-based triggers and later a GPS check tied to known workshops, and some train batches shut down at specific stations including Mińsk Mazowiecki.
- Dragon Sector members Michał, Sergiusz, and Jakub helped diagnose and fix the issue for SPS and are named in the lawsuits alongside SPS.
- Newag filed claims in Warsaw for 6,453,000 PLN and in Gdańsk for 5,100,000 PLN, totaling the equivalent of over $3 million USD.
- Newag has said hackers added the code and has at times charged around 25,000 EUR per unlock for locked trains.
- EU case law generally allows reverse engineering to diagnose and fix software bugs, which could affect the legal merit of Newag’s claims.
- Last month three more trains were temporarily locked in Poland and Newag initially refused to unlock them before relenting.