Cyberattack on ePUAP: Poland — government services platform taken offline as precaution after attack
Severity: medium · Patch status: unknown · Since 2026-11-10
Poland's Digital Affairs Ministry took ePUAP, the national platform citizens and businesses use to file official documents and exchange messages with agencies, offline as a precaution after officials said a cyberattack on it had been detected and stopped. The Record reports the minister, Krzysztof Gawkowski, made that statement on Tuesday, 10 November; the article is dated 11 November. A ministry spokesperson said the attack did not compromise the system or disrupt its operation and that it was disabled only as a precaution. The Central Information Technology Center that runs ePUAP says its infrastructure remains secure. A government notice quoted by The Record says ePUAP electronic mailboxes are unavailable to citizens and public institutions, and the Trusted Profile digital identity system could also be temporarily affected. Officials gave no restoration timeline (services are to resume once security specialists finish), no attack method, no attribution, and no confirmation that data was accessed or stolen. The only 2026 coverage found is The Record's piece; the government notice itself was not reached, and the scope of the outage beyond mailboxes is unconfirmed. Until service returns, use other channels for official submissions and treat unsolicited messages that claim to come from ePUAP or Trusted Profile as phishing.
What to do
- Monitor official Polish government channels (gov.pl) for restoration of ePUAP and Trusted Profile services
- Use alternative channels for submitting official documents while ePUAP is offline
- Be alert for phishing that may exploit the outage or impersonate government services
- Review access logs and identity verification processes if your organisation relies on Trusted Profile for e-signatures
Sources
All live incidents on Threat Watch
