Poland has taken ePUAP, the platform citizens and businesses use to file official documents and deal with government agencies, offline after a cyberattack. Digital Affairs Minister Krzysztof Gawkowski said the attack was "detected and stopped." Ministry spokesperson Marek Gieorgica told the Polish news agency PAP the system was not compromised or disrupted by the attack: "We simply disabled it as a precautionary measure." According to The Record, no restoration timeline has been given. ePUAP mailboxes remain unavailable, and the Trusted Profile digital-identity system could also be affected.
The case for pulling the plug
The strongest argument for a shutdown is simple. When defenders do not yet know how an attacker got in, or what else they touched, leaving a system running can turn a contained incident into a systemic one. ePUAP is a gateway to Trusted Profile, which lets people sign official documents electronically. A forged or hijacked identity session in that chain could cause harm well beyond the platform itself. Taking a service down early costs inconvenience. Taking it down late can cost trust in the state's digital infrastructure.
That logic is sound, and regulators should not punish it. The reports so far say the attack was stopped, that the infrastructure of the Central Information Technology Center remained secure, and that there is no public confirmation that data was stolen. If those statements hold, a precautionary shutdown is what good incident response looks like.
What the public still does not know
The same reports also show where the gaps are. Authorities have not said how the attack was carried out or who was responsible. They have not said when ePUAP will return. The distinction between "not compromised" and "taken offline as a precaution" is also hard for outsiders to test. A system can be both unharmed and shut down for days, and users cannot tell which part of that sentence matters most to them.
The cost falls on ordinary users. Businesses file official documents through ePUAP and individuals use it to deal with agencies. Deadlines, applications and correspondence with public bodies do not pause when a server does. Governments that run mandatory digital channels take on a duty to provide fallbacks. That means accepting paper or in-person filings, extending deadlines automatically, and saying publicly that they have done so.
What EU law already requires
The EU framework addresses much of this. The NIS2 Directive (EU) 2022/2555 requires covered entities to manage risk through measures that include business continuity, backup management, disaster recovery and crisis management. For significant incidents it sets a staged reporting process: an early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within one month of that notification.
Poland has recently brought this regime into national law. Osborne Clarke reported on 20 February 2026 that the President had signed the amendment to the National Cybersecurity System Act, with the new provisions entering into force one month after publication. The firm also noted that administrative fines for failing to meet the obligations would be imposed only after two years from entry into force. That grace period is sensible. It lets organisations build real capacity before penalties apply, rather than building paperwork to avoid them.
The ePUAP episode is therefore a useful test of whether the system works as designed, and the answer depends less on the shutdown than on what follows. The directive's reporting structure is built around the information the public currently lacks: what happened, how severe it was, and what is being done about it.
A proportionate standard for judging the response
A pro-innovation approach to cybersecurity policy does not mean treating every outage as a failure or every precaution as an overreaction. It means asking a few concrete questions of any operator, public or private.
- Was the response fast? Detection and containment within hours is the goal, and an early shutdown can be the right call.
- Was disclosure honest and timely? Operators should say what is known, what is not, and when the next update will come. "No timeline" is acceptable on day one. It is not acceptable on day ten.
- Were users protected during the outage? Fallback channels and deadline relief are the practical measure of a service's resilience.
- Was the post-incident review published? Lessons shared across the EU improve everyone's defences more than penalties do.
Penalty-first approaches create the wrong incentive. If operators expect to be punished for visible disruption, they will be tempted to keep compromised systems running, or to minimise what they disclose. Rules that reward containment and candour push the other way.
The wider context
The attack lands in a tense environment. The Record notes that Poland has faced repeated attacks on government institutions, critical infrastructure and private companies in recent months. In September, hackers stole data from the Polish healthcare software provider Qbusoft after a separate breach involving the medical technology company MyDr, an incident Polish authorities said potentially affected information about 19 million people and roughly 12,000 healthcare organisations. In October, the invoicing provider Fakturownia reported a data breach.
These are separate events, and nothing published so far links them to the ePUAP incident. But they show why resilience, not just prevention, is the right policy focus. Attackers will sometimes get through. What matters is how quickly a system recovers and how much users learn along the way.
Digital identity raises the stakes. The EU's European Digital Identity Framework, Regulation (EU) 2024/1183, adopted on 11 April 2024, moves member states toward more identity-based public services. As more public functions depend on a few identity and filing platforms, the quality of incident response on those platforms matters more.
Bottom line
Poland's decision to take ePUAP offline is defensible on what is known today. The test now is the next few days: a clear account of the incident, a credible restoration plan, and a fallback for people with deadlines. Regulators and legislators across the EU should draw one lesson. Standards that reward prompt containment and honest disclosure will produce more resilient public services than rules that treat every outage as a violation.