The article discusses the issue of computer crimes (cybercrimes) involving the disruption of the functioning of ICT networks. Objective: To assess the criminal law provisions in force in Poland concerning attacks on data and information systems (Articles 268a, 269, 269a of the Penal Code) and to identify their inconsistencies and the legislative changes needed. Methods: The author conducts a dogmatic analysis of the provisions, compares their content with practical interpretative problems, contrasts them with EU regulations (Directive 2013/40) and the Convention on Cybercrime, and refers to doctrinal viewpoints. Conclusions: The provisions overlap, are imprecise, and are inadequate in light of contemporary threats. Articles 268a and 269a partially duplicate each other, while Articles 268 §2 and 269 §2 are unnecessary. It is essential to clarify the scope of protection for data and systems, to organize the relationships between the relevant articles, and to increase penalties for attacks on critical infrastructure so that Polish law meets the requirements of Directive 2013/40 and the realities of cybersecurity.