Newag S.A. (pronounced "nevag") is a Polish company, based in Nowy Sącz, specialising in the production, maintenance, and modernisation of railway rolling stock. The company's products include the 14WE, 19WE, 35WE types electric multiple units. The company has also developed the Nevelo prototype tram^[2] and formed a consortium with Siemens Mobility for final assembly of Siemens Inspiro metro trains for the Warsaw Metro and Sofia Metro.

In 1876 (when Nowy Sącz was partitioned by Austria-Hungary), the Imperial–Royal Railway Workshops opened, serving the newly built Tarnów–Leluchów railway line [pl]. After the First World War and the establishment of the Second Polish Republic, the company, renamed "1st Class Main Workshop", was redirected to serve Polish State Railways (PKP), employing some 1,800 workers in 1922. In post-World War II communist Poland the workshop was nationalised and later became a separate, though still state-owned, enterprise officially called "Nowy Sacz Railway Rolling Stock Repairs Depot in Nowy Sacz, State Independent Enterprise" (Polish: Zakłady Naprawcze Taboru Kolejowego "Nowy Sącz" w Nowym Sączu, Przedsiębiorstwo Państwowe Wyodrębnione; ZNTK Nowy Sącz), with a workforce of about 3,500 in 1952. ZNTK Nowy Sącz serviced its last steam locomotive (a TKt48) in 1972.

After the fall of communism and the economic changes of 1989, ZNTK Nowy Sącz was transformed into a State Treasury Joint Stock Company, with the Polish state as the only shareholder. The company went through a period of financial turmoil around 2001 and its shares were acquired by a private domestic investor in 2003. The current name was adopted in 2005. In 2008, Newag acquired ZNTK Gilwice and subsequently integrated the latter's operations into the wider company.

• Nevelo – three-section low-floor tramcar, currently in service in Kraków
• Impuls – electric multiple unit for urban, suburban or regional services
• Vulcano – diesel multiple unit, currently in service in Italy
• Griffin – four-axle electric or diesel-electric locomotive for express passenger and light-medium freight services
• Dragon – six-axle high-power electric or diesel-electric locomotive for heavy freight services

Locomotives and EMU are available with optional last-mile diesel.

The company has set up an electrified, 245 metre long test track to test the electric rolling stock it manufactures or modernises. The overhead can be supplied with any of the four systems, commonly used on European railways: 1.5 and 3 kV DC, 15 kV 16.7 Hz and 25 kV 50 Hz.^[3]

At the OhMyH@ck conference held in Warsaw on 5 December 2023, software engineers from white hat hacker group Dragon Sector revealed that they had reverse engineered the embedded software of Newag 45WE Impuls EMUs after operator Koleje Dolnośląskie had experienced a number of mysterious breakdowns when maintenance was performed by their selected contractor Serwis Pojazdów Szynowych (SPS).^[4] In Newag's opinion, the issues were a result of malpractice by SPS and the trains should have instead been serviced by Newag.^[5][6]

Analysis of the software revealed that the train's embedded computers were programmed to lock up and display bogus fault messages and prevent the train from running if a GPS tracker detected that it spent a certain number of days in an independent repair company’s maintenance center, and also if certain replacement parts had a serial number not approved by the manufacturer.^[7][8]

In an investigation conducted with the help of the Polish Office of Rail Transport [pl] and CERT Polska, it was also discovered that the software locks could be bypassed by pressing a sequence of buttons in the cab of the train, although a later software update removed this ability.^[9] The Dragon Sector group analysed 29 trains belonging to Koleje Dolnośląskie as well as other affected operators such as Koleje Mazowieckie, SKM Warszawa, WKD and Polregio, 24 of which had software locks which were removed using tools developed by the group. After those findings were made public, former Minister of Digital Affairs Janusz Cieszyński confirmed the Polish government and Polish intelligence agencies had known about the findings since May.^[10] It was also revealed that the Polish Internal Security Agency (ABW) had, in October 2022, submitted a case against Newag regarding the abovementioned software manipulation incidents to the prosecutor's office in Nowy Sącz, which initially downplayed the incident until said findings publicly came to light, after which, the investigation was taken over by the regional prosecutor's office in Kraków on suspicion of crimes committed under Article 269 §1 and Article 286 §1 of the Polish Penal Code.^[11]

Newag strongly denied the claims they intentionally disabled their software and instead alleged SPS was propagating a conspiracy theory to avoid contractual penalties for being unable to service the trains. Newag also claimed there is no proof they are the author of the software or that the modifications had been introduced by them. Newag stated it would take legal action against SPS and the Dragon Sector group for slander and defamation.^[12]

The Dragon Sector hacker group subsequently gave a presentation at the 37th Chaos Communication Congress (37C3) in Hamburg on 27 December 2023, where they explained in detail the process of debugging the train software and their findings.^[13]

On 17 January 2024, the Sejm's Parliamentary Committee for Combating Transport Exclusion convened a hearing regarding the abovementioned allegations, whose participants included representatives of the Dragon Sector team, Newag, railway operators and members of the Sejm.^[14]