VULNpocalypse
MediumEcosystem changeMonitoring

Poland’s Digital Ministry says it stopped a cyberattack on ePUAP

The Record reports Poland took ePUAP offline as a precaution after a cyberattack the ministry says was stopped; check gov.pl for service status.

Published
Exploitation
Not confirmed. The ministry says an attack was detected and stopped; the method and any access to systems are not disclosed.

What happened

According to The Record, Poland temporarily shut down ePUAP, a nationwide platform for submitting official documents and communicating with government agencies, after a cyberattack. The Record reports that officials said the attack was detected and stopped. Polish Digital Affairs Minister Krzysztof Gawkowski wrote in a social media post, as quoted by The Record, that “The cyberattack on the state ePUAP system was detected and stopped.”

The Record says Gawkowski stated that the infrastructure of the Central Information Technology Center, the agency that maintains ePUAP, remained secure. Digital Affairs Ministry spokesperson Marek Gieorgica told the Polish news agency PAP, as cited by The Record, that the system was not compromised or disrupted by the attack and was disabled “as a precautionary measure.”

What is not confirmed, according to The Record:

  • How the attack was carried out is not disclosed.
  • Who was responsible is not disclosed.
  • There is no public confirmation that hackers gained access to government systems or stole sensitive information.
  • The ministry has not given a timeline for restoring the platform. It says services will resume once security specialists finish their work.

The official government portal gov.pl carries a notice that, because of ongoing service work (“prace serwisowe”), ePUAP mailboxes are currently unavailable to citizens and offices. That notice does not mention a cyberattack. It also says Trusted Profile and e-signature services may be briefly unavailable on Thursday 12 November between 22:00 and 23:00. The Record adds that the disruption could temporarily affect the Trusted Profile digital identity system, which is used to access public services and sign documents electronically.

Am I affected?

  • ePUAP users (citizens, businesses, public institutions): According to the gov.pl notice, ePUAP mailboxes are currently unavailable. The Record reports the same.
  • Trusted Profile and electronic signature users: The Record says these may be temporarily affected. The gov.pl notice lists a possible brief outage on 12 November, 22:00 to 23:00.
  • Data exposure: Not confirmed. Officials, as reported by The Record, say the system was not compromised, and there is no public confirmation of access to systems or data theft. No CVE or software vulnerability is named in the sources.

What to do now

  1. Check the notice on gov.pl for the current ePUAP status before attempting to submit or collect official documents.
  2. If you have time-sensitive procedures, plan around the unavailability of ePUAP mailboxes. The sources give no restoration date.
  3. Avoid relying on Trusted Profile or e-signature services during the 12 November 22:00 to 23:00 window listed by gov.pl.
  4. Watch for updates from the Digital Affairs Ministry, which has said services will resume once security specialists finish their work. No further guidance is confirmed in the sources.

Sources