Poland healthcare sector faces multiple medical data breaches

medical data breach cyberattack patient privacy Enel-Med cybersecurity regulations

Poland's healthcare sector is facing a series of significant cyberattacks targeting sensitive patient data. Enel-Med reported a security incident on September 24, 2026, which may have compromised approximately 3 percent of its patient database. The company has since notified the Central Bureau for Combating Cybercrime and other regulatory bodies.

In a separate incident, the Medyc system has been targeted. A perpetrator linked to previous attacks claims to have seized data from up to 5 million people. A confirmed breach at an addiction treatment facility in Inowrocław exposed highly sensitive information, including names, PESEL numbers, and contact details. Experts warn that the merging of different leaked datasets could allow criminals to create detailed patient profiles for use in blackmail and sophisticated phishing attempts.

In response to these escalating threats, the Polish Ministry of Digital Affairs has announced plans to introduce new security regulations. These measures aim to strengthen how medical data is processed and stored, with a particular focus on private companies that manage large-scale healthcare information.

Entities

CERT Polska · Inowrocław · Medyc · Ministry of Digital Affairs · enel-med

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] An IT security incident occurred on September 24, 2026, involving unauthorized access to part of the company's IT infrastructure. www.wnp.pl
[○ 1 SOURCE] A data breach at the Addiction Treatment and Psychiatric Day Ward in Inowrocław confirmed the theft of names, PESEL numbers, addresses, phone numbers, and emails. naszbiznes24.pl
[○ 1 SOURCE] The data breach may affect approximately 3 percent of Enel-Med's entire patient database. www.wnp.pl
[○ 1 SOURCE] Enel-Med notified the Central Bureau for Combating Cybercrime, CESIRT, Cert Polska, and the President of the Personal Data Protection Office. www.wnp.pl
[○ 1 SOURCE] A perpetrator claiming to be linked to the MyDr attack asserts they have seized data belonging to up to 5 million people from the Medyc system. naszbiznes24.pl
[○ 1 SOURCE] The Ministry of Digital Affairs is preparing new regulations to improve the security of patient information following recent cyberattacks. www.biznesinfo.pl