Newag

Newag S.A. is a publicly traded Polish manufacturer of railway rolling stock based in Nowy Sącz.^[1] Between 2022 & 2023, independent researchers found that its Impuls electric multiple units stopped running after being serviced at third-party workshops because the trains' onboard software contained routines that locked them out.^[2][3] Newag denies installing any locks, calls the findings defamatory, & has sued the repair firm & the researchers who published them.^[4][5]

Newag traces its origins to an 1876 railway repair works in Nowy Sącz & now designs, builds, & modernizes rolling stock as a public company listed on the Warsaw Stock Exchange under the ticker NWG.^[1][6] Its main products are the Griffin & Dragon electric locomotive families & the Impuls family of multiple units.^[7][8][9]

This is a list of all consumer protection incidents this company is involved in. Any incidents not mentioned here can be found in the Newag category.

Main article: 2023 Newag Impuls software locks

In 2022, independent maintenance firm Serwis Pojazdów Szynowych (SPS Mieczkowski) took in Koleje Dolnośląskie Impuls units for scheduled overhauls, & the trains refused to start once the work was done even though nothing was mechanically wrong.^[10][2] SPS hired the Polish security collective Dragon Sector, & three of its members, Michał "Redford" Kowalczyk, Sergiusz "q3k" Bazański, & Jakub "MrTick" Stępniewicz, reverse engineered the trains' programmable logic controllers.^[11][2]

The decompiled code contained several conditions that would disable a train.^[12][2] One controller held hardcoded GPS coordinates, & one pair, 53.13845 & 17.99011, resolves to a site next to Bydgoszcz Główna station used by the competing manufacturer PESA; a train that sat inside such a geofence was blocked from moving.^[2] Another routine disabled a unit that had stood still in a workshop for at least 10 days, a threshold a later Newag firmware update raised to 21 days.^[2][5] The software also paired components by serial number over the CAN bus, so replacing a part with an identical working unit locked the train, & separate date logic reported a false compressor fault once the calendar passed a fixed date.^[2] Because the compressor raises the pantograph that draws power from the overhead line, that fault left the train unable to move.^[2]

The locks left no diagnostic error on the cabin screen; the train read as ready, released its brakes on command, & then would not engage the traction motors.^[2][13] Dragon Sector found that an undocumented sequence of button presses in the cab cleared the lock, though a Newag update later removed that sequence while leaving the lock logic in place, & added cabin messages warning of a copyright violation.^[12][2] One controller was wired to a GSM modem through a device labeled a UDP to CAN converter that broadcast the lock state, which Bazański said appeared able to lock a train remotely.^[12][2] Dragon Sector analyzed the software of 29 Impuls units & found the lock routines across a fleet operated by carriers including Koleje Dolnośląskie, Koleje Mazowieckie, POLREGIO, & SKM.^[2][14] The team presented the work at the 37C3 congress in December 2023 & published a follow-up on the legal fallout at 38C3 a year later.^[13][15]

Newag denies installing any lockout, geofence, or timer, & describes the reports as slander from competitors.^[4][14][16]

After the findings were published on December 5, 2023, its share price fell by as much as 17% before closing the day down about 6%, & the company said the report amounted to manipulation of its share price.^[16] Newag's public position is that its software was altered without authorization by a third party.^[4] That account sits against its own court filing, which states that no altered software was installed as part of Dragon Sector's work; iFixit noted that Newag simultaneously argues the researchers endangered passengers by modifying the software & that they did not modify it at all.^[17][5]

The President of Poland's Office of Competition & Consumer Protection (UOKiK), Tomasz Chróstny, opened an explanatory proceeding on December 7, 2023, at the request of Razem party members of parliament Paulina Matysiak & Adrian Zandberg, to examine whether Newag restricted competition in the market for train servicing.^[18][14] The Regional Prosecutor's Office in Kraków opened a separate criminal investigation, & in 2024 prosecutors & police searched Newag's headquarters in Nowy Sącz to secure records.^[14][19]

In August 2024, Newag began legal action against SPS & the Dragon Sector researchers, seeking damages for copyright infringement, unfair competition, & harm to its reputation.^[17][5][21]

The claims were split across two courts, one seeking about $1.7 million & the other about $1.36 million.^[21] Newag's filing bases the copyright claim on the researchers decompiling its train software rather than on any change to the code, which its own filing says was not altered.^[17][5] iFixit & Techdirt framed the suits as Newag targeting the people who exposed the locks, & the researchers detailed the litigation & their legal defense in their 38C3 talk.^[5][21][15] As of August 2025 the litigation remained ongoing.^[21]

iFixit & Techdirt covered the case as a right to repair dispute, reporting that Newag used software locks & copyright claims against the researchers who exposed them.^[5][21] iFixit wrote that the copyright claim rests on the researchers reverse engineering the train software.^[5]

• Leo Express
• Digital rights management
• Right to repair
• Digital Millennium Copyright Act