Poland took its national ePUAP e-government platform offline after a cyberattack was detected and stopped, Digital Affairs Minister Krzysztof Gawkowski said. Citizens and institutions lost access to ePUAP electronic mailboxes, and the government has not given a restoration timeline.
What Polish Officials Have Said About the Attack
Gawkowski said the attack on ePUAP was detected and stopped and that infrastructure at the Central Information Technology Center remains secure. The Record reported the event on Tuesday, November 10, in text published November 11, while Security Affairs also covered it.
The Ministry’s Precautionary Shutdown Account
Ministry spokesperson Marek Gieorgica said the system was not compromised or disrupted. He said officials disabled it as a precaution. The statement draws a line between an attack that the government says it caught and a successful intrusion, though the government has not published evidence for either reading.
Attack Method and Perpetrator Still Undisclosed
Officials have not disclosed how the attack was carried out or who was behind it. The government has not confirmed whether anyone accessed data on the platform. No details have been released about the type of attack, such as whether it involved intrusion attempts or traffic flooding.
Services Citizens and Businesses Lost Access To
ePUAP electronic mailboxes became unavailable to both citizens and institutions. Those mailboxes serve as the channel through which people and organizations submit official documents to public bodies online. With the platform down, citizens and businesses are temporarily unable to submit official documents electronically.
Possible Knock-On Effect for Trusted Profile Signing
The Trusted Profile digital ID system, which people use to sign documents, may also be temporarily affected. Reporting describes the effect on Trusted Profile as possible rather than confirmed, so the extent of the disruption to document signing remains unclear.
Restoration Work Continues Without a Timeline
As of November 12, restoration work was ongoing. Security teams are working to restore functionality, and officials said services will resume after specialists finish their work. The government has set no date for the return of the mailboxes or the Trusted Profile signing function.
The case shows the tension in how governments communicate about incidents against national platforms. Polish officials described the attack as stopped and the infrastructure as secure while keeping the service offline, a combination that gives users little visibility into how long the outage will last. The shutdown was a defensive decision, and the ministry has presented it as such.
The platform sits at the center of Poland’s digital public services, so the outage affects anyone who needs to exchange formal documents with an office or agency. Reporting so far rests on two sources, The Record and Security Affairs, both of which relay the ministry’s statements. Neither report identifies an attacker or a technique, and Polish authorities have not confirmed whether any data was reached before the platform was disabled.
Sources and Gaps in the Public Record on the ePUAP Outage
The Record and Security Affairs both reported the shutdown, and both relay statements from Gawkowski and Gieorgica. The reports do not describe how the attack was detected, which part of the platform was targeted or how long the disruption will last.
The ministry’s position, that the system was not compromised or disrupted and that the infrastructure remains secure, stands alongside the fact that mailboxes remain unavailable. Officials have given no confirmation either way on data access, and the sources describe no claim of responsibility.
Government statements so far separate three things: the attack, which officials say was detected and stopped; the shutdown, which they call a precaution; and the restoration, which they describe as work in progress. The next confirmed milestone would be a date for the return of the mailboxes, and none has been announced.
