Poland creates CSIRT Energia to defend its energy grid

A wide remit

The ministry supervises nearly 1,200 entities in cybersecurity terms. The new team will cover every energy subsector named in the national cybersecurity act: electricity generation and transmission, heating, gas, oil, fuels and hydrogen, as well as electric-vehicle charging infrastructure and nuclear power projects.

A CSIRT does more than clean up after attacks. It detects suspicious activity, analyses vulnerabilities and warns other organisations. If an attacker exploits a flaw in one operator's equipment, other companies could be alerted faster and check their own systems.

Prompted by recent attacks

The decision follows a coordinated attack on 29 December 2025 that hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company. Analyses by CERT Polska found the operation was destructive rather than aimed at extorting a ransom. Attackers reached some industrial automation devices and disrupted communication with selected renewable farms, but did not halt generation or cause power outages. At the large heat and power plant, security systems stopped an attempt to run malware.

A supplementary CERT Polska report in August revealed that a second heat and power plant was also hit, with a brief halt to its cogeneration process; operators' response kept heat supplies running. Separately, an unauthorised person changed boiler settings at a heating plant in Ruciane-Nida, and prosecutors are investigating.

The ministry says national CSIRT teams handled almost 273,000 incidents in 2025, across all sectors. CSIRT Energia will not remove the risk of sabotage or replace technical safeguards, but as Poland's grid relies on more distributed, remotely controlled installations, faster sharing of threat information could matter as much as protecting any single plant.