Newag backdoor

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, visit the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

Newag S.A.

Basic information
Founded	1876
Type	Manufacturer
Industry	Rail
Official website	https://www.newag.pl/

Newag S.A. (pronounced "nevag") is a publicly traded Polish company based in Nowy Sącz that specializes in the production, maintenance, and modernization of railway rolling stock. Their most notable products include: the families of electric locomotives Griffin and Dragon, as well as the Impuls family of multiple units.

Anti-competitive practices

In 2022, a regional Polish train operator commissioned a third-party repair service - SPS - to complete maintenance on Impuls trains. The repair service could not, however, bring the trains to move despite them being in working order. This, alongside accusations of "interfering with the trains' security systems" by Newag caused a tarnishing of SPS's reputation. In 2023, however, a group of Polish cybersecurity experts from Dragon Sector, after being hired by SPS, disclosed findings that a number of lock-up mechanisms were placed in the trains' software. These allegedly include:

1. A "lack of movement timer", which would disable the train after it has not moved for a set amount of time.
2. Geofencing - the train would disable itself once it detects that it is in one of Newag's competitors' workshops.
3. Serializing the CAN bus extension device of the train, disabling it if a change in the CAN's serial number is detected.
4. A date check, which would cause the train to lock up if it was not serviced by Newag before the 21st of November 2022, claiming compressor failure.

The geofencing mechanism has later been shown to allegedly be the cause of disruptions on a connection serviced by Impuls trains, having them disable themselves when passing near one of the geofenced locations. The date check, meanwhile, was poorly implemented, and would only cause the train to be locked from 11/21 to 12/1 and from 12/21 to 1/1 each year after 2021.

Newag firmly denies any claims of wrongdoing, releasing multiple statements claiming the findings of Dragon Sector, as well as reports from media outlets, are "slander" from their competition, "which is conducting an illegal campaign of black PR against us." Newag claims they "have not, do not and will not introduce" any software locks. The statements also implied an attempt to "undermine Newag's market position".

The investigation against Newag is still on-going.