MPass two-step and EVOSign login temporarily disabled after cyberattack

The E-Government Agency (AGE) has temporarily disabled two MPass login methods: two-step authentication and the EVOSign app. The move is preventive, as the system undergoes extra security checks after the 19–23 October cyberattack.

Public digital services can still be accessed via MPass with a mobile signature, an electronic signature or an identity card. In the EVO phone app, login currently works only with a mobile signature. AGE says the disabled options will return once checks are complete. According to the agency, data linked to about 750,000 personal ID numbers (IDNP) were extracted in the attack, including identification details, insurance status and financial information such as IBANs.

What it means for you

• If you file reports or documents through MPass-based services, make sure you have a valid mobile or electronic signature.
• Be wary of calls and messages asking for bank details or codes — stolen data may be used for fraud.
• Brief staff who handle payments and accounting.

Source: ZdG, 28.10.2026