In December 2025, Poland experienced a coordinated attack against its energy sector. The incident did not cause blackouts and did not destabilise the national grid. Electricity continued to flow.
That outcome, however, should not be mistaken for reassurance.
The official investigation by CERT Polska documents how dozens of renewable energy sites, a major combined heat and power plant, and an industrial company all lost operational visibility and control at the same time.1 Communications were disrupted, equipment was damaged, and recovery was deliberately delayed. Independent analysis by Dragos shows that this event represents a broader shift in how modern energy systems are being affected as they become more distributed and digitally operated.2
This is not a story about malware. It is a story about energy system resilience in a world where generation, demand, and control are increasingly decentralised.
What happened in Poland
On 29 December 2025, coordinated destructive activity affected multiple parts of Poland's energy sector. According to the official CERT Polska report, the attackers focused on grid connection points and the systems used to remotely monitor and manage renewable energy facilities.3
At least 30 wind and solar farms were affected. In each case, communication between the facility and the distribution system operator was lost. Generating equipment continued to operate, but operators could no longer monitor or control it remotely. At the same time, a large combined heat and power plant and a manufacturing company were attacked using similar access methods and destructive techniques.
Independent incident response work by Dragos characterises this as the first publicly documented, coordinated attack at scale against distributed energy resources, rather than against central grid infrastructure.4 Unlike earlier energy-sector incidents that focused on control centres or transmission substations, this operation targeted the distributed edge of the grid: wind farms, solar installations, and the communications infrastructure that connects them.
Once access was obtained, devices were deliberately damaged or reset, credentials were changed, and logs were erased.5 These actions did not immediately interrupt electricity generation, but they removed operators' ability to see what was happening and slowed safe restoration of normal operations.
Why the grid stayed up — and why that isn't the point
Poland's electricity system remained stable for reasons unrelated to the attack itself. The affected sites represented a limited share of total generation capacity, and the wider system had sufficient inertia and redundancy to absorb the loss of visibility at those locations.
This distinction matters.
Dragos notes that in distributed energy systems, loss of communications does not automatically shut down generation. Assets often continue operating, but operators lose the ability to monitor, coordinate, or safely control them.6 This explains why electricity continued to flow in Poland while still representing a serious operational incident.
CERT Polska is explicit that, given the level of access achieved, there was a real risk of disrupting electricity generation, even though that outcome did not occur on the day.7 The absence of outages reflects system conditions, not the absence of vulnerability.
As energy systems become more decentralised, resilience increasingly depends on how thousands of smaller assets are connected, accessed, and managed—not just on the strength of the high-voltage grid.
Why this matters for renewables and data centres
Ireland is moving rapidly toward an energy system built around distributed assets:
- Wind and solar farms that are unmanned and remotely operated
- Rapid expansion of microgeneration across homes, farms, and businesses
- Growth in data centres and other large energy users, often paired with on-site or proximate generation, storage, and flexible connections
Ireland's regulator has already recognised the system impact of this shift. The Commission for Regulation of Utilities (CRU) notes that electricity demand growth driven by large energy users—particularly data centres—has been faster than the delivery of new grid infrastructure and generation capacity.8
“The pace at which new electricity demand is being sought by data centres is faster than the pace of network infrastructure delivery and the development of new generation capacity.” — CRU Large Energy Users Connection Policy Decision Paper (Dec 2025)9
Dragos highlights that distributed energy resources differ fundamentally from traditional generation. They are more numerous, rely heavily on remote connectivity, and are often developed under tight commercial constraints that prioritise speed and standardisation.10 These characteristics increase efficiency, but they also mean that the same access methods, devices, and configurations are frequently repeated across many sites.
The Polish incident shows how this repetition creates a new form of risk. A weakness at one location does not stay local; it can be exploited repeatedly across an entire portfolio of assets.