Data of 19 million Polish patients stolen in cyberattack on MyDr platform

Full text

Keep our news free from ads and paywalls by making a donation to support our work!

Notes from Poland is run by a small editorial team and is published by an independent, non-profit foundation that is funded through donations from our readers. We cannot do what we do without your support.

The personal data of almost 19 million people, including medical information, has been compromised in a major cyberattack on a company that provides services to thousands of medical facilities in Poland.

“We are dealing with one of the largest data leaks in [Poland’s] history,” said digital affairs minister Krzysztof Gawkowski on Wednesday. He urged people to use government services to check whether their data is affected and to “lock” their national identity number to prevent potential fraud.

(🧵 1/2) 💬 Dziś doszło do poważnego wycieku danych w firmie MyDr, który może obejmować blisko 19 milionów osób korzystających z opieki medycznej. W związku z sytuacją krytyczną zostały natychmiast podjęte działania mające zabezpieczyć dane i wyjaśnić okoliczności incydentu –… pic.twitter.com/nIp6EvbKiu

— Ministerstwo Cyfryzacji (@CYFRA_GOV_PL) August 12, 2026

The attack targeted MyDr, a company that provides services used by many medical facilities in Poland. Its data includes patients’ personal information, as well as medical details such as diagnoses and prescriptions.

It was first reported on Monday by Zaufana Trzecia Strona, an IT security news service, which said that it had been contacted on Saturday by the alleged perpetrators, who claimed to have accessed the data of around 18.8 million people.

The hackers, who have not been identified, had also sent a screenshot from the compromised database showing the personal data of “one of the most important politicians in Poland”, added Zaufana Trzecia Strona.

Shortly afterwards, MyDr confirmed that it had “become the target of an external, deliberate criminal activity involving some of our data”. In an update on Wednesday, it said that, at the time of writing, there was no evidence that the data had been published anywhere.

Największy wyciek danych osobowych w historii Polski i co możemy z nim zrobić – nasza analiza incydentu w MyDr i jego potencjalnych skutków. https://t.co/vXUmVfpPAP

Opisujemy aktualny stan wiedzy i możliwe scenariusze rozwoju sytuacji. pic.twitter.com/uqhjz1CjZ1

— ZaufanaTrzeciaStrona @zaufanatrzeciastrona@infosec (@Zaufana3Strona) August 13, 2026

Gawkowski addressed the issue at a press briefing on Wednesday. He noted that “there is no indication we are dealing with an external attack…from Russia or any other country”. Poland has recently regularly been targetted by Russian state-linked hackers .

It is “very likely” that cybercriminals are behind the attack on MrDr, said Gawkowski, who pledged that there would be an “uncompromising” response from the Polish security services.

The minister advised Poles to check in a secure government database whether their data had been leaked. He also advised citizens to use the state web portal, known as mObywatel, to “lock” their identity number, known as a PESEL, which prevents fraudsters from using it.

Around 12,000 medical facilities use MyDr’s services, the digital affairs ministry told the Polish Press Agency (PAP). The company claims that it processes three million medical consultations and 2.7 million prescriptions a month, reports the Gazeta Wyborcza daily.

Notes from Poland is run by a small editorial team and published by an independent, non-profit foundation that is funded through donations from our readers. We cannot do what we do without your support.