---
id: "CMP-202611-mrj5ei"
page: "https://infrastack.ai/live/CMP-202611-mrj5ei"
kind: "campaign"
aliases: []
title: "Poland's ePUAP e-government portal taken offline after a cyberattack the minister says involves foreign adversaries; expect scams posing as ePUAP"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ePUAP", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-13T09:01:34+00:00"
updated_at: "2026-11-13T09:01:54+00:00"
sources: [{"source": "analyst", "url": "https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/", "first_seen_at": "2026-11-13T09:01:34+00:00", "cites": ["https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/"]}]
exploit_sources: []
---

# ePUAP attack: Poland's ePUAP e-government portal taken offline after a cyberattack the minister says involves foreign adversaries; expect scams posing as ePUAP

Link for people: https://infrastack.ai/live/CMP-202611-mrj5ei (this .md is for agents)

Poland temporarily suspended its ePUAP e-government portal after a cyberattack detected this week (exact date unknown). Minister of Digital Affairs Krzysztof Gawkowski said evidence suggests foreign adversaries are involved; no actor named. Government IT teams are investigating and restoring the platform. Whether user data was taken is unknown. Reported by the minister on X and TVN24 (via Risky Bulletin, 13 Nov 2026).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :ePUAP affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says only that a cyberattack forced ePUAP offline and that foreign adversaries may be involved, with no account of how the attacker got in, and whether user data was taken is unknown, so the path is also unclear beyond the expected scams.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#unknown

## How to check

Messages claiming to be from ePUAP or the Polish government about the outage, account re-verification or password resets, especially links not on gov.pl domains. Specific lure text or domains: unknown.

## Fix

Do not follow links in emails or SMS about ePUAP; go to the official gov.pl site directly. Organizations relying on ePUAP for filings should plan for the outage and watch for official restoration notices.

## Timeline

- 2026-11-13T09:01:34+00:00 analyst https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/

## Documents

- [describes] @campuscodi.risky.biz: -Chinese APT uses SS7, Diameter attacks to spy on targets
-Cyberattack takes dow https://bsky.app/profile/campuscodi.risky.biz/post/3n26lk2jlbs2l
- [describes] Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets https://news.risky.biz/risky-bulletin-chinese-apt-uses-ss7-diameter-attacks-to-spy-on-targets/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_