SPS Mieczkowski beat Newag by proving the maker's code bricked trains it serviced

Newag, a Warsaw-listed train maker from Nowy Sącz, long dominated servicing of its Impuls electric multiple units by treating its maintenance documentation as proprietary, so operators had to use the manufacturer's expensive workshops. A reinterpretation of EU railway rules opened the work to independent firms, and SPS Mieczkowski, a workshop near Bydgoszcz, began winning those multi-million-złoty servicing tenders at lower prices.

In 2022 four Impuls trains from Lower Silesia that had been serviced at SPS refused to start. Koleje Dolnośląskie fined SPS more than two million złoty for late delivery, and Newag spread the story that the workshop was incompetent; vehicles sent back to Newag ran again after an extra payment. Then trains that had never reached SPS also stopped, including some that had simply stood parked for more than a few days, which made the bad-repair narrative untenable.

SPS hired Dragon Sector, one of Poland's top security teams. Over two months the researchers reverse-engineered the Impuls control computers — IEC 61131-3 logic compiled through C into assembly with no strings to search — and found deliberate kill routines: locks triggered after ten days idle, geofences hardcoded to SPS's own service halls (one of them still under construction), and a date condition that bricked a train from 21 November onward each year while the cab reported a compressor fault.

Once word spread that SPS had people who could solve the mystery, ten operators sent them 29 vehicles. On 5 December 2023 Dragon Sector presented the findings at the Oh My H@ck conference in Warsaw and Onet published the story. Newag denied everything and blamed third parties, but Poland's Central Anti-Corruption Bureau was investigating, Koleje Dolnośląskie said it would consider cancelling the penalties and suing the manufacturer, and the case became a 1,076-point Hacker News discussion.

Treat the machine's firmware as evidence, not as a mystery

The firmware was a silent witness: hardcoded dates and GPS coordinates cannot be explained away as a repair mistake or a parts fault.

The analysis was independent of both the workshop and the manufacturer, so its conclusions carried weight with operators, regulators and courts.

Unblocking trains gave operators a fix and a reason to talk, and word of mouth brought 29 vehicles from ten companies to Dragon Sector.

The public report flipped liability: the customer that fined SPS said it would reverse the penalties and sue Newag, and the anti-corruption bureau opened a case.

When you're blamed for failures in equipment whose code you don't control, buy independent forensics before paying the penalty: the firmware keeps the author's record.

As of December 2023 the affected trains were back in service, and Koleje Dolnośląskie said its Impuls units had run without problems since the fix while it considered cancelling the penalties it had imposed on SPS and taking Newag to court. Newag denied the allegations, said third parties had interfered with its trains and cited a 99 percent reliability record, but commenters noted its stock fell after the story broke. The case became a national scandal, a 1,076-point Hacker News discussion, and an investigation by Poland's anti-corruption bureau.