MyDr cyberattack potentially exposes medical data of 19 million patients

A massive cyberattack on the MyDr software provider has potentially compromised the sensitive medical data of up to 19 million patients. The breach affects approximately 12,000 medical facilities that utilize the software. Hackers reportedly exfiltrated nearly 2 terabytes of data, a process estimated to have taken days or weeks, raising concerns regarding the timely detection of the intrusion.

The Personal Data Protection Office (UODO) has received hundreds of breach notifications from data administrators, including medical practices and clinics, with more expected. UODO has initiated an inspection of MyDr. While the Ministry of Digital Affairs has directed citizens to a government portal to check for data exposure, officials clarified that the portal will not contain actual medical records, such as treatment histories or prescriptions, due to privacy restrictions.

Responsibility for the breach primarily lies with the data administrators—the individual clinics and doctors—rather than the software provider. UODO noted that when determining penalties, it will consider whether administrators reported the breach themselves and whether they informed the affected individuals.