Poland takes national ePUAP services platform offline after stopping cyberattack

Poland's flagship online public services platform went dark on the night of November 10, 2026, after the country's cybersecurity services detected and stopped a hacking attempt against it. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski announced the incident in a post on X, saying that teams responsible for the state ePUAP system had acted immediately and that the platform had been taken offline as a precaution. The Internal Security Agency, known by its Polish initials ABW, was brought in to establish how the attack was carried out and who was behind it.

ePUAP is the backbone of Polish digital administration. The nationwide system lets citizens and businesses file applications, submit official documents and correspondence, and complete administrative procedures with public bodies without visiting an office. It also underpins the Trusted Profile, the government backed digital identity used to sign documents electronically, which means disruption to ePUAP can ripple into services that depend on that identity layer.

The platform is maintained by the Centralny Osrodek Informatyki, or Central Information Technology Center, the state agency that runs key digital registries and services. Gawkowski said the COI infrastructure itself remained secure, an early signal that the attack did not reach the core systems the centre operates. Ministry officials described the shutdown as a deliberate safety measure rather than a response to visible damage. The precise mechanics of the attempt remain undisclosed: no attack method has been published, no responsible party has been named, and there has been no public confirmation that anyone reached government systems or took sensitive data.

The incident lands in a punishing stretch for Polish public institutions. Poland has absorbed a run of breaches and ransomware attacks over the past year, from a Culture Ministry digital system to a hospital in Szczecin, and Microsoft has placed the country among the ten most frequently targeted by Russian state linked hacking groups. For a government that has made digitisation a signature project, the timing is uncomfortable.

Key Facts

Gawkowski published the first public confirmation at 20:59 CET on November 10, 2026, according to CEO Magazine Poland, which reported on November 10 that the minister used X to say the attack had been halted and the system kept stable. He did not specify which services had been disrupted or when the technical work would be completed. In the same statement he said security teams had responded immediately and were working to restore the platform's full functionality, and that the reaction of the teams protecting key state registries was instantaneous, which allowed the stability of the infrastructure to be preserved.

The Record reported on November 11 that ePUAP was taken offline as a precaution rather than because of damage caused by the attack. Ministry spokesperson Marek Gieorgica told the Polish Press Agency that the system had not been compromised or its operation disrupted, adding that it was simply disabled as a precautionary measure to be certain that its further operation would be fully secure.

WP Wiadomosci reported on November 11 that the system was disconnected from the network overnight from Tuesday into Wednesday to guarantee the full security of data, and that the ABW was engaged to explain the circumstances of the incident. Money.pl reported on November 11 that Gieorgica spoke to PAP after 23:00 on November 10 and said it was hard to say when full functionality would return, expressing hope that it would be as soon as possible.

A notice on the government website said ePUAP electronic mailboxes remained unavailable to citizens and public institutions, and the disruption could temporarily affect the Trusted Profile digital identity system used to sign documents electronically, The Record reported. No restoration timeline has been published by the ministry.

The wider numbers are stark. Microsoft ranked Poland among the ten countries most frequently targeted by Russian state linked hacking groups between July 2025 and June 2026, TVP World reported on November 10. A September 2026 breach at healthcare software provider Qbusoft followed a separate incident at medical technology company MyDr that Polish authorities said potentially affected data relating to about 19 million people and roughly 12,000 healthcare organisations. In October, online invoicing provider Fakturownia also reported a data breach.

Analysis

The immediate question is whether this was an intrusion caught at the perimeter or something deeper that was interrupted partway through. Officials have disclosed almost nothing technical: no attack vector, no attribution, and no confirmation that hackers reached government systems or stole sensitive information. What this really means is that the public is being asked to accept a containment story without the forensic detail that would make it verifiable, and that gap will shape how the incident is judged once the ABW finishes its work.

The decision to pull a working national platform offline is itself the most revealing fact. Governments rarely accept the political cost of disabling a service used daily by citizens and businesses unless the risk of leaving it running is judged higher. Gieorgica's insistence that nothing was compromised sits alongside the reality that mailboxes went dark and the Trusted Profile was exposed to knock on effects, a combination that points to deep caution around a system whose integrity could not be confirmed quickly.

The bigger picture here is that Poland's defensive posture is being tested faster than its disclosure practices can keep up. The country has now logged a Culture Ministry breach in October, the Fakturownia invoicing breach in October, the Qbusoft and MyDr healthcare episodes in September, and a March ransomware attack on a public hospital in Szczecin. Each incident was handled competently enough in isolation, but the cumulative pattern describes a state estate with a very large attack surface and a limited supply of quiet nights.

Attribution matters less than resilience at this stage. Whether the ePUAP attempt came from a state actor, a criminal group or a proxy, the operational lesson is the same: a platform that concentrates identity, document submission and administrative workflow in one place is a high value target, and disconnecting it is a blunt instrument that works once but cannot become routine. The Trusted Profile dependency in particular turns a single platform outage into a national authentication problem.

Why It Matters

For ordinary Poles and for companies that deal with the state, ePUAP is not a convenience feature, it is the front door. Filings, applications and official correspondence route through it, and electronic signatures depend on the Trusted Profile. An outage of even a day stalls deadlines, procurement paperwork and interactions that have no immediate offline substitute at the same speed.

The incident also tests public confidence in the government's digital programme at a moment when ministers are already arguing publicly with platform companies over fraud and impersonation. Gawkowski has clashed with Meta over its response to AI driven scams impersonating Polish institutions, a dispute that has sharpened Warsaw's sensitivity to online deception and state linked disruption. A silent or slow explanation of the ePUAP event would undercut the credibility of that campaign.

There is a European dimension too. Poland's platform concentrates identity and document flow at national scale, and the COI runs registries that other services lean on. When a system like this is disconnected, the effects are not contained to one ministry's portfolio; they propagate through every process that assumed ePUAP was available.

Next Up

The ABW investigation now carries the burden of explaining what happened. Authorities have not said how the attack was carried out or who was responsible, and there has been no public confirmation that hackers gained access to government systems or stole sensitive information. The ministry has also declined to give a restoration timetable, saying only that intensive technical and verification work is under way.

Expect the pressure to move to disclosure. Once ePUAP returns, the questions will be whether the shutdown was proportionate, whether the Trusted Profile was ever at risk, and whether Poland will publish enough detail for other European administrations to learn from the attempt. The record of the past year suggests the next incident is a matter of when, not if.