Poland has temporarily shut down ePUAP, the national platform citizens and businesses use to reach public services online, after detecting and stopping a cyberattack. Digital Affairs Minister Krzysztof Gawkowski disclosed the incident on the social media platform X at 8.59pm on Monday 10 November.

ePUAP, the Electronic Platform of Public Administration Services, is the system through which Poles submit official documents, communicate with government agencies and complete administrative procedures online. A notice on the government’s website says ePUAP electronic mailboxes are unavailable to citizens and public institutions while the work continues.

Taken offline as a precaution

Gawkowski, who also serves as a deputy prime minister, said the attack had been detected and halted. “The teams responsible for the system’s security took immediate action to maintain its stability, and technical work is currently underway to restore full functionality,” he wrote. Officials stressed that the platform was taken offline as a precaution, not because the attack caused damage. Marek Gieorgica, a spokesperson for the Digital Affairs Ministry, told the Polish news agency PAP that the system had not been compromised or disrupted by the attack.

The minister said the infrastructure of the Central Information Technology Centre, the agency responsible for ePUAP and other key digital services, was not affected. Poland’s Internal Security Agency, known as ABW, has joined the investigation into the circumstances of the incident. Security Affairs reports the same account from the minister’s statement and the ministry.

ePUAP is more than a website. It is the front door to Polish public administration online, and it is tied to the trusted profile system Poles use to sign documents and prove their identity to the state. Taking it offline, even briefly, cuts off a route that citizens and businesses rely on for everyday dealings with the authorities, from filing forms to receiving official correspondence. That is why the ministry moved to shut it down rather than risk an attacker reaching the mailboxes and documents inside.

Many questions still open

Authorities have not explained how the attack was carried out or who was behind it, and there is no public confirmation that attackers accessed government systems or stole sensitive data. The ministry has not given a timetable for restoring services, saying they will return once security experts complete their checks. Full service had still not been restored by Tuesday evening, according to Polish reporting.

The ePUAP cyberattack fits a wider pattern of attacks on Polish targets in recent months. In October, Fakturownia, an online invoicing service, disclosed a data breach that may have exposed information belonging to its users, customers and business partners, and healthcare software firms Qbusoft and MyDr were also hit. A second independent report confirms the minister’s statement, the ABW involvement and that full service was not yet restored.