[REVISION HISTORY]

Polish medical data breaches

Updated 2 times since CLSTR started tracking revisions of this situation.

What changed

2026-09-25 08:52 UTC → 2026-09-25 16:18 UTC · added ~~removed~~

Poland has experienced significant cyberattacks targeting medical data systems. An initial breach at the MyDr medical system potentially compromised the personal and health information of 18.8 million people and affected over 12,000 medical facilities. The Ministry of Digital Affairs reported that the unauthorized access involved historical data up to April 2024, including names, PESEL numbers, and sensitive medical visit notes. Subsequent reports identified a specific vulnerability in the Medyc software, developed by the Olsztyn-based company Qbusoft, which was exploited via a SQL injection. During a breach occurring between August 22 and August 23, 2026, attackers stole an encrypted database archive. One affected facility, the Addiction Treatment and Psychiatric Center in Inowrocław, reported that the compromised data could include names, PESEL numbers, addresses, phone numbers, email addresses, and sensitive medical documentation such as hospital discharge summaries. Minister of Digital Affairs Krzysztof Gawkowski confirmed the incident and stated that the Central Bureau for Combating Cybercrime is conducting an investigation. Gawkowski noted that Qbusoft failed to report the incident to CERT Polska or the CSIRT CeZ team, promising ‘absolute consequences’ if security procedures were violated. While the stolen data was encrypted, experts warned the encryption was weak and easily bypassed. ~~Some reports suggest~~ Newer developments regarding the Medyc software breach indicate a discrepancy in the scale of the impact. While initial estimates suggested approximately one million patients were affected, the attackers, using the pseudonym ‘fingerprint,’ ~~may be the same group responsible~~ claim to have stolen data for ~~the previous massive leak involving the MyDr service.~~ 5 million people and 8 million private photos.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.