Poland takes ePUAP offline after detecting a cyberattack

Poland disconnected ePUAP, its nationwide e-government platform for submitting official documents and interacting with public agencies, after detecting and stopping a cyberattack. Digital Affairs Minister Krzysztof Gawkowski announced on the evening of November 10 that "the cyberattack on the state ePUAP system was detected and stopped," and the platform was taken offline overnight as a precaution. The Internal Security Agency (ABW) is investigating. Officials say the system was not breached — the outage is a deliberate protective measure, not a consequence of the attack.

What happened

Per reporting from Recorded Future's The Record and Polish outlets including Wirtualna Polska and Money.pl, administrators disconnected ePUAP preventively after detecting the intrusion attempt. Ministry spokesperson Marek Gieorgica said: "We simply disabled it as a precautionary measure," adding that the system's operation was not disrupted by the attack itself. Gawkowski said the infrastructure of the Centralny Ośrodek Informatyki (COI), which maintains ePUAP, remained secure.

Neither the attack method nor any responsible party has been disclosed. There is no public confirmation that attackers accessed government systems or exfiltrated data.

What's affected

• ePUAP electronic mailboxes are unavailable to citizens and public institutions while the platform is offline.
• The Trusted Profile (Profil Zaufany) digital-identity service, which rides on ePUAP, may be temporarily affected — though officials note an ePUAP outage does not automatically take down every Profil Zaufany function.
• No restoration timeline has been given; services resume once COI and security teams finish their work.

What to do today

For Polish organizations and administrators that depend on ePUAP:

1. Plan for extended downtime. No restoration date has been set. Identify processes that route through ePUAP mailboxes or Profil Zaufany and prepare alternative channels for statutory deadlines.
2. Do not route around the shutdown. The disconnection is deliberate; wait for the ministry's all-clear rather than seeking unofficial access paths.
3. Watch official channels. Track gov.pl/cyfryzacja and the ministry's statements for status and for any later disclosure of scope.
4. Be alert for themed phishing. Outages of national identity platforms are routinely exploited with "reactivate your Profil Zaufany" lures. Warn staff and citizens-facing teams.

Context

This lands amid a sustained run of incidents against Polish public and private systems. Gawkowski has repeatedly framed Poland as among the most-targeted states in Europe. Recent months brought a breach at invoicing provider Fakturownia in October and a September incident involving healthcare software firms Qbusoft and MyDr that authorities said potentially touched roughly 19 million people. None of these has been publicly linked to the ePUAP attack, and attribution here remains open — no group has claimed responsibility. The notable detail is the response pattern: Warsaw is now willing to pull a core national service offline on detection rather than ride out an active attack, a posture shift worth watching as other governments weigh the same trade-off.