Poland has taken ePUAP, its nationwide platform for submitting official documents and dealing with government agencies online, offline after detecting a cyberattack. Digital Affairs Minister Krzysztof Gawkowski said on 10 November that the attack was “detected and stopped” (The Record’s translation of his Polish post). The Record reports the platform was taken offline as a precaution and not because of damage. Who is behind it, how it was carried out and what, if anything, was accessed have not been disclosed.
What is known
According to The Record, which reported on 11 November, ePUAP lets citizens and businesses submit official documents, communicate with agencies and complete administrative procedures. The minister said the infrastructure of Poland’s Central Information Technology Center, the agency that maintains key digital services including ePUAP, remained secure. In the same post, he said the Internal Security Agency (ABW) was brought in under procedure to fully clarify the incident and that findings would be shared as they emerge (our translation of the Polish original, one source).
The Record quotes ministry spokesperson Marek Gieorgica, speaking to the Polish news agency PAP (we could not read the PAP article, which is behind a login): “It’s not that the system was somehow compromised or its operation was disrupted by this attack. We simply disabled it as a precautionary measure.” The Record reports that a notice on the government website says ePUAP electronic mailboxes remain unavailable to citizens and public institutions, and that the Trusted Profile digital identity system, used to access services and sign documents electronically, could also be temporarily affected. No restoration timeline has been given.
Context
The Record notes Poland has faced repeated attacks on government bodies, critical infrastructure and companies in recent months, listing the October data breach at invoicing provider Fakturownia and the September theft of data from healthcare software provider Qbusoft, following a separate breach of MyDr. Polish authorities said the MyDr incident potentially affected information relating to about 19 million people and roughly 12,000 healthcare organisations. Nothing in the reporting links these incidents to the ePUAP attack. No evidence found as of 12 November 2026, in The Record, the minister’s 10 November post or the PAP lead paragraph (the full PAP article is paywalled), of any actor or link to those earlier breaches being stated. We did not search other outlets.
What it means
Our assessment: this is an availability story for now. A precautionary shutdown of a national document-exchange and identity-linked service means citizens, businesses and agencies lose a routine channel for official correspondence, and the length of the outage will depend on what investigators find. The official account says the attack was stopped and the platform was not compromised; that is the ministry’s statement, and the sources we read contain no independent confirmation. Severity “medium” and the sector tags are our judgement.
Recommended actions
These are our guidance, not from the sources.
- Organisations that deal with Polish agencies: expect delays on submissions made through ePUAP, confirm deadlines with the receiving authority, and keep proof of attempted submission.
- Anyone relying on Trusted Profile sign-in: watch for official notices before assuming related services are available.
- Security teams in Polish public bodies and suppliers: watch for phishing that exploits the outage, such as messages claiming ePUAP mailbox problems and asking users to log in or verify details.
- Everyone: rely on gov.pl and ministry channels for restoration notices.
We will update this briefing if the ministry publishes attribution or technical details.