Poland is facing what may become one of the largest personal data breaches in the country’s history after government officials confirmed that data linked to nearly 19 million Polish citizens may have been exposed through systems connected to MyDr, a provider of software for medical facilities and electronic medical documentation.
According to Polish Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski, the stolen dataset is believed to contain more than 2 TB of data and concerns people who used medical support in different categories. Interia reported that MyDr operates in the healthcare software sector and cooperates with services including ZnanyLekarz.
What Happened
The incident first gained public attention after the cybersecurity portal Zaufana Trzecia Strona reported that alleged attackers had contacted its journalists and claimed to possess patient data from numerous Polish medical clinics. The attackers claimed to have obtained 18,814,422 unique PESEL numbers, Poland’s national identification number.
CyberDefence24 later reported that the case was discussed during a meeting of Poland’s Joint Cybersecurity Operations Center on August 12, where Gawkowski confirmed that the leak affected close to 19 million people.
The scale is extraordinary. In practical terms, this means the incident may involve data relating to more than every second citizen of Poland.
Why This Breach Is Different
This is not just another leak of names, phone numbers, or email addresses.
The most sensitive part is the medical context. According to Interia’s expert interview, the exposed information may include PESEL numbers, contact details, and health-related data. Cybersecurity specialist Krzysztof Kaliński warned that medical data can be used not only for financial fraud, but also for more complex forms of abuse, including blackmail based on illnesses, medications, or private health conditions.
Under GDPR, health data belongs to a special category of personal data that receives additional protection because of its sensitive nature.
That is what makes this incident so dangerous. A leaked password can be changed. A phone number can sometimes be replaced. But medical history, prescription data, diagnosis-related information, and health context cannot simply be reset.
What Criminals Could Do With the Data
If the attackers’ claims are accurate, the stolen data could be valuable on criminal markets for a long time.
Possible abuse includes:
- identity theft using PESEL and personal details
- loan or credit fraud, especially through weaker financial checks
- targeted phishing pretending to come from clinics, pharmacies, doctors, or government services
- fake medical billing or prescription-related scams
- blackmail using sensitive health information
- social engineering calls where criminals already know personal and medical details
- long-term profiling of victims
Kaliński warned that attackers may sell the data on the black market or attempt financial fraud, including loan fraud through non-bank lenders.
Government Response
The Polish government says it has launched a special procedure to help citizens check whether their data is included in the leak.
According to Interia and CyberDefence24, leaked information is expected to be added to the government portal Bezpieczne Dane, where citizens will be able to verify whether their data appeared in the breach.
The official Bezpieczne Dane service allows users to log in and check whether their phone numbers, email addresses, logins, or PESEL numbers have appeared in known leaks.
Gawkowski also said that systems belonging to the affected company had been blocked and later restored to safe, normal operation. The government also started informing doctors who used the system, covering around 12,000 medical facilities.
What Citizens Should Do Now
Even before confirmation appears in Bezpieczne Dane, the safest assumption is that personal data may already be exposed.
The most important step is to reserve your PESEL number.
This can be done through the mObywatel app, the mObywatel website, or in person at a municipal office. Since June 1, 2024, Polish financial institutions have been required to check the PESEL restriction register before granting loans, and notaries must also check it before certain property-sale activities.
Recommended actions:
- Reserve your PESEL immediately.
Keep it reserved by default and temporarily unreserve it only when you need to complete a legitimate banking, credit, or notarial process. - Check Bezpieczne Dane when the dataset becomes available.
Use only the official government website and avoid links sent by email or SMS. - Watch for phishing and scam calls.
Criminals may use real medical or identity details to sound convincing. - Change reused passwords.
CERT Polska recommends changing passwords connected to breached services, especially if the same or similar passwords are used elsewhere. - Enable two-factor authentication.
This is especially important for email, banking, medical portals, cloud storage, and social media accounts. - Monitor financial activity.
Check bank accounts, credit inquiries, debt registers, and alerts from mObywatel or financial monitoring services. - Be careful with “verification” messages.
After large breaches, criminals often send fake government, bank, clinic, or cybersecurity notifications.
Why Healthcare Providers Must Treat This as a Wake-Up Call
This incident also raises serious questions for the healthcare sector.
Healthcare software providers, clinics, and medical platforms process some of the most sensitive information possible. They must assume that attackers are not only after money, but also after identity data, medical history, prescriptions, and patient relationships.
Medical technology providers should urgently review:
- access controls and privileged accounts
- production database access
- backup security
- logging and anomaly detection
- encryption of sensitive fields
- segmentation between clinics and tenants
- third-party access
- incident-response processes
- data minimization practices
- breach notification readiness
CyberDefence24 noted that Poland has recently seen several serious cyber incidents affecting healthcare-related organizations, including hospitals, clinics, rehabilitation centers, laboratories, and medical providers.
The lesson is clear: healthcare data is now one of the most valuable criminal targets.
Final Thoughts
The MyDr incident is not only a technical breach. It is a national-scale privacy event.
If nearly 19 million people are affected, the consequences may last for years. PESEL numbers, contact details, and medical information can be reused across phishing, fraud, extortion, and identity-theft campaigns long after the original attack is over.
For citizens, the immediate priority is to reserve PESEL, monitor official government tools, and stay alert for scams.
Medical systems must be secured as critical infrastructure, because when they fail, the damage is deeply personal and impossible to fully undo.
