Poland takes its system for official letters to government offline after a cyberattack

Poland has taken ePUAP offline after a cyberattack. ePUAP is the national platform for sending official letters and documents to and between public bodies. Digital Affairs Minister Krzysztof Gawkowski announced on X on the evening of 10 November that the attack had been "detected and stopped", and the system was disconnected overnight as a precaution. According to The Record, the ministry says the attack did not breach the system or disrupt it. On 11 November, ePUAP mailboxes were still unavailable, and no date for full restoration had been given.

What the government has said

Gawkowski, who is also deputy prime minister, wrote that security teams took immediate steps to keep the system stable and that technical work to restore it was under way. He said the infrastructure of the Central Information Technology Centre (COI), which runs ePUAP, is secure. Marek Gieorgica, head of the ministry's communications office, told the PAP news agency: "We simply disabled it as a precautionary measure."

Gieorgica also said that full service will return only once the COI team finishes its work, and that "no specific date can currently be given" for that, Prawo.pl reports. The ABW is investigating. Officials have not said whether this was an attempt to overload the service or to break into it, and they have not named a suspect.

The attack was spotted shortly before 9 pm on Tuesday, dobreprogramy writes. On Wednesday morning, the ePUAP homepage showed a notice about a break in access to the mailboxes for both citizens and offices, describing it as maintenance work.

Who is affected

For most residents the impact is smaller than it sounds. Since the start of 2026, people and businesses mainly contact public administration through e-Doręczenia, Poland's electronic registered delivery service. ePUAP is still used for correspondence between offices and for cases before administrative courts, and courts, prosecutors, bailiffs and police still rely on it for now. Under the e-Doręczenia law, offices can keep using ePUAP among themselves until 30 September 2029.

According to The Record, a government notice warned that the Trusted Profile digital ID, used to log in to public services and sign documents, could also be temporarily affected. On Wednesday morning, an IT training firm checked other government services and found no outage notices for Trusted Profile, the mObywatel app, e-Doręczenia or the tax portal. The ministry itself has not published a list of what works.

For anyone with a deadline, Polish administrative law offers some protection. 11 November is a public holiday, so a deadline that falls on it moves to the next working day. A letter sent to an office's e-Doręczenia address before the deadline counts as filed on time. If an outage beyond your control makes you miss a deadline, you can ask for it to be restored within seven days after the cause ends.

A run of attacks on Poland

Poland has faced repeated cyberattacks on public bodies and companies in recent months. In October, the invoicing service Fakturownia reported a breach that may have exposed data on users, customers and business partners. In September, hackers stole data from the healthcare software firm Qbusoft. That followed the breach of the MyDr medical records system, which we covered in August, potentially affecting about 19 million people and roughly 12,000 healthcare organisations.

There is no public confirmation that the attackers got into ePUAP or took any data. Until the mailboxes return, the people hit hardest are officials, lawyers and courts that depend on ePUAP for their daily correspondence.