Poland's CSIRE reaches its final rollout stage: what people and businesses should know

An energy-market infrastructure change can remain invisible to customers while billing and supplier switching work normally. It can also give fraudsters a convincing pretext: “activate your CSIRE account,” “confirm your energy consumption point” or “pay a migration fee.” A real system change makes the false message sound plausible.

On October 19, 2026, Poland began the final statutory stage for onboarding further participants to the Central Energy Market Information System, known as CSIRE. Polskie Sieci Elektroenergetyczne (PSE) says the remaining distribution system operators, along with suppliers and balancing-responsible parties serving points on their networks, are to conduct market processes through CSIRE from that date.

The system has operated since July 1, 2025 and was introduced in stages. PSE acts as the energy market information operator, OIRE. Its general CSIRE information explains that the platform supports data exchange and processes such as supplier switching, billing and default supply.

Breachroad’s conclusion: customers should not take an urgent action merely because a message cites a genuine CSIRE date. For organisations, the rollout is not only an integration project—it changes access to data, ownership and error-handling processes.

What changes for an energy customer

CSIRE is intended to organise information exchange between energy-market participants. A customer may experience its effects indirectly through supplier switching, settlement, data corrections or default supply. It does not mean that every customer must personally open a new account, install software or confirm details through a text-message link on October 19.

Verify energy-related messages through a channel you open independently:

1. sign in to the customer portal from your own bookmark or typed address;
2. retrieve the agreement and consumption-point numbers from an earlier bill;
3. call the number printed on the contract or official website, not the message;
4. pay only to an account confirmed in a known portal and on a genuine invoice;
5. never give a one-time payment code, password or card details to someone “guiding the migration.”

A real system transition and a fraudulent message can occur at the same time. The safe response is neither blind clicking nor ignoring a genuine billing problem. Separate the substance of the issue from the authenticity of the channel.

An important qualification: the date does not prove every integration is complete

On October 15, Poland’s Ministry of Energy described new rules for a safer and more efficient energy market. The regulation allows the President of the Energy Regulatory Office to refrain from imposing a penalty for technical or organisational delay if integration is completed by April 19, 2028 and the statutory conditions are met.

This is not a blanket deadline extension or proof that every participant is delayed. It does show why “everything works identically everywhere from October 19” would be an overstatement. Organisations should establish the status of their actual network operator and supplier rather than build plans around a general announcement alone.

What an energy-market participant should verify

A distributor, supplier or service provider handling CSIRE processes needs more than evidence that an interface responds. Controls should cover:

• the OIRE agreement and assigned organisational roles;
• data migration completeness and consumption-point consistency;
• professional user portal accounts and permissions;
• certification of an in-house B2B system or the status of the selected certified physical sender;
• monitoring of rejected, delayed and duplicate messages;
• a path for data correction and customer complaint handling;
• incident procedures for an incorrect data, account or supplier change.

PSE says privacy by design and privacy by default were built into the project and that a risk assessment followed ISO/IEC 29134:2017. Those are important design measures, but they do not remove each participating organisation’s responsibility for its own accounts, integration, administrator endpoints and suppliers.

What every business paying an energy bill should do

The security impact is not limited to energy companies. Finance may receive a message about a “new bank account after CSIRE migration.” Reception may get a call requesting a consumption-point code. A small-business owner may react quickly to a disconnection threat because downtime would halt operations.

Adopt four straightforward safeguards:

• verify a supplier bank-account change through a second, independent channel;
• require two-person approval for payment-detail changes;
• retain previous invoices and payment-account history for comparison;
• teach finance, reception and administration that “urgent migration” pressure does not replace verification.

A message that includes a genuine consumption-point number or contract fragment can still be fraudulent. Contextual data increases credibility; it does not authenticate the sender.

Responding to an error or suspicious change

First preserve the message, email headers, phone number, time and visible details. Contact the supplier or network operator through an official channel and ask it to confirm the process status. In a business, hold any payment change until independently verified.

If money was sent to a fraudulent account, contact the bank immediately and report the fraud. If an account was compromised or data changed without authorisation, revoke sessions, preserve logs and activate the incident plan. Correcting market data and investigating a cyber incident may need to run as parallel workstreams.

Source facts and our recommendations

Rollout dates, participant roles and process scope come from PSE notices. The possibility of waiving a penalty under specified conditions and the April 19, 2028 date come from the Ministry of Energy. Those sources do not report a specific phishing campaign tied to CSIRE.

The message scenarios, independent bank-account confirmation and dual approval for payment changes are Breachroad analysis and recommendations. Our guides explain how to handle a utility shutoff payment threat and a supplier bank-account change on an invoice. Organisations can turn those scenarios into repeatable behaviour through cybersecurity training for employees and assess accounts and integrations with an IT security audit.