What Is CERT Polska?
Author: Domeny.ForSale editorial team Published
In brief: CERT Polska is a team within NASK that analyses online threats and responds to security incidents. You can report suspicious text messages, fake banking websites, messages designed to steal data, or malware, among other things. Reporting helps contain the threat, but does not replace contacting your bank, the police, or the administrator of the affected system.
What is CERT Polska, and where does it operate?
CERT stands for Computer Emergency Response Team: a team that responds to computer incidents. An incident is an event that compromises the security of data or systems, such as an account takeover, a computer infection, or unauthorised access to a company network.
CERT Polska operates within NASK — Naukowa i Akademicka Sieć Komputerowa (the Research and Academic Computer Network), a state research institute. The team carries out the duties of CSIRT NASK, one of Poland’s three national-level incident response teams, alongside CSIRT GOV and CSIRT MON. CSIRT is a term similar to CERT: it stands for Computer Security Incident Response Team.
These names do not refer to a single institution that handles every case. The individual teams have different areas of responsibility. For a private individual wishing to report an online scam, CERT Polska is an appropriate point of contact.
What exactly does CERT Polska do?
The team receives reports, analyses how attackers operate, and takes steps to limit the impact of threats. One example is phishing: impersonating a trusted person or organisation to persuade the recipient to disclose data, make a payment, or take another unsafe action.
CERT Polska’s activities include:
- analysing fake websites, suspicious messages, and malware;
- issuing warnings about identified scam campaigns;
- working with network operators, service providers, and other security teams;
- publishing guides, reports, and tools that help protect systems;
- maintaining a Warning List of dangerous websites.
The Warning List contains domains used for scams. Operators and administrators who use it can restrict access to those addresses. A domain’s absence from the list does not confirm that it is safe — a new scam website may not yet have been identified.
CERT Polska is not, however, a computer repair service or an institution that recovers money. Submitting a report does not guarantee that a website will be removed, an account recovered, or an individual response provided with a full analysis.
What can you report, and how?
A report is warranted when you see signs of a scam or a security breach. You do not have to prove who is behind the attack yourself. Reports of fake login pages, messages containing links requesting additional payments, suspicious attachments, and compromised websites distributing harmful content are particularly useful.
You can forward a suspicious text message to 8080, using your phone’s message forwarding function. Other incidents can be reported through the form available on CERT Polska’s official website. Check that website directly for current reporting channels, reporting rules, and technical limitations, rather than using a link sent in a suspicious message.
A useful report should include:
- a brief description of the event and the approximate time it occurred;
- the address of the suspicious website or the contents of the message;
- information about whether you clicked a link, provided data, made a payment, or ran a file;
- any available materials, such as a screenshot or the original email, in accordance with the form’s instructions.
Do not reopen a dangerous website just to gather more evidence. Do not send passwords, authorisation codes, or unnecessary personal data. When submitting a report on behalf of a company, also take care to protect confidential information.
Example: a text message requesting an additional delivery payment
You receive a text message saying that your parcel has been held and requires a small additional payment. The link leads to a website resembling a courier’s site, which asks for your card details. A small amount does not mean it is safe: the scammers may be trying to obtain details that allow them to make much larger charges.
If you have not opened the link, forward the text message to 8080 and check the parcel’s status by opening the carrier’s app yourself or visiting its known website. Do not reply to the sender or make a payment through the link you received.
If you have already entered your card details, first contact your bank through an official channel and follow its instructions for securing your card and transactions. Then report the website to CERT Polska. Keep the message and transaction confirmations, particularly if you have lost money.
When do you also need to contact your bank, the police, or an administrator?
CERT Polska deals with the technical aspects of threats. A suspected crime, such as theft of money or misuse of someone’s identity, may require a separate report to the police or the public prosecutor’s office. Reporting an incident to the team does not replace such a report.
Also report an account takeover to the service provider, and an incident involving work equipment to your company’s IT or security department. Do not delete files yourself or reinstall the operating system on a work computer before agreeing on the steps to take: doing so may make the incident harder to analyse.
Organisations may be subject to additional legal requirements and reporting deadlines. This description is not individual legal advice; the appropriate procedure should be confirmed in current official guidance. If the threat is affecting you now, start by securing your money, accounts, or devices, and prepare your report without any further contact with the scammer.
Read also
