Polish officials have confirmed the theft of medical and personal data linked to nearly 19 million citizens from MyDr, a private electronic medical records platform used across thousands of Polish clinics and practices. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski called the incident "unprecedented" and, per TRT World's account of his remarks, said that "as confirmed by the company itself, 19 million records were stolen, containing various types of data that can be linked together." Notes From Poland quotes Gawkowski describing it as "one of the largest incidents in Poland's history." Critically for attribution watchers, Gawkowski stated there are currently no indications the data was stolen in an attack by another country, and Prime Minister Donald Tusk, per Pollar's reporting of his Thursday press conference, characterised the motive as "purely criminal" and likely an attempt to extort a ransom. Poland has spent the past eight months absorbing confirmed Russian state activity against its energy grid, so the explicit decoupling of this incident from that campaign is the single most important qualifier in the government's messaging.
What Happened
The timeline assembled from Polish reporting is tight. Pollar cites Piotr Antoni Skiba, spokesperson for the Warsaw district prosecutor's office, stating the perpetrator gained unauthorised access to MyDr's servers no later than 6 August 2026 by breaking or circumventing IT security measures, an offence carrying up to three years' imprisonment. On Saturday 8 August, the IT security news service Zaufana Trzecia Strona was contacted directly by the alleged perpetrators, who claimed access to the data of around 18.8 million people and, according to Notes From Poland, supplied a screenshot from the compromised database displaying the personal data of "one of the most important politicians in Poland." Zaufana Trzecia Strona published first, on Monday 11 August, the same day prosecutors opened investigative actions ex officio. The Ministry of Digitalisation confirmed the attack on Wednesday 12 August, with the CBZC (Poland's central cybercrime bureau) formally launching its investigation the same day. Tusk and Gawkowski held press conferences on 13 August.
MyDr itself confirmed it had "become the target of an external, deliberate criminal activity involving some of our data," per Notes From Poland. Accounts differ slightly on scale depending on who is counting what: the attackers claimed roughly 18.8 million people to Zaufana Trzecia Strona, while Gawkowski and the company reference approximately 19 million stolen records. Headline figures across Anadolu Agency, TRT World, Brandsit, Pollar and EU Startups News converge on "nearly 19 million," but treat the person-count and record-count as related, not identical. Poland's total population is roughly 37 million, so on either figure this touches on the order of half the country.
What Was Taken
Per Pollar and Brandsit, both citing Gawkowski, the stolen database exceeds 2 TB. The reported contents are a near worst case combination for downstream fraud: names, PESEL national identification numbers, phone numbers, email addresses, doctors' visit notes, and prescription information. Notes From Poland adds diagnoses to that list.
The PESEL number is the pivot. It is Poland's universal identity and credit key, which is why Gawkowski's public advice was for citizens to use government services to check exposure and to "lock" their PESEL against fraudulent credit applications. Bundle PESEL with a verified phone number, an email address, and a specific diagnosis or prescription, and an attacker has everything needed for high credibility social engineering against banks, insurers, pharmacies, and the victims themselves. Brandsit notes the consequences extend beyond identity theft to significantly more convincing phishing built on real medical context.
One clarification worth carrying: MyDr has been part of the Docplanner group since 2023, alongside ZnanyLekarz. Brandsit reports, citing information provided to CRN, that the two systems are separate and do not exchange data, and that there is no indication of a ZnanyLekarz breach. That is single OTHER-tier sourcing and should be treated as a company-side claim pending independent confirmation.
Why It Matters
This is a third-party concentration failure, not a hospital breach. Brandsit and Pollar both report MyDr's software is used by around 12,000 healthcare facilities for electronic medical records, appointment management, e-prescriptions and e-sick notes. As Brandsit puts it, patients may find themselves in the MyDr database without ever having heard of the brand, having only used their own local clinic. Every one of those 12,000 facilities is a GDPR data controller carrying obligations for a dataset it did not hold and could not directly defend.
The scale multiplier is the entire lesson. A single compromised backbone provider produced an exposure equal to a breach of half the national population, something no individual clinic could have generated. Brandsit reports Polish cybersecurity incident volumes rose 144 percent year on year in 2025, and this incident sits at the top of that curve.
It also lands in a specific geopolitical context that defenders should not conflate. In parallel reporting, SecurityWeek and Infosecurity Magazine detail CERT.PL's disclosure of a second December 2025 attack on Polish energy infrastructure attributed to Sandworm, the Russian state-linked APT, in which attackers reached a CHP plant's OT network and forced the shutdown of a steam turbine and water treatment system. Poland is simultaneously absorbing destructive state-sponsored operations against critical infrastructure and, on the government's current read, ordinary criminal extortion against its health data supply chain. Gawkowski's answer to the extortion question was blunt, per TRT World: "Nobody will negotiate with anyone. Nobody will give in to any blackmail."
The Attack Technique
Honest assessment: the initial access vector for the MyDr breach has not been disclosed. The prosecutor's office has said only that the attacker broke or circumvented IT security measures to reach MyDr's servers no later than 6 August. Tusk described the incident as involving "very sophisticated techniques and methods," but no technical detail, malware family, or named actor has been released, and no group has been publicly identified. Gawkowski said cybersecurity services are still working to establish how the incident occurred. Anyone claiming a specific vector today is ahead of the evidence.
For contrast on what a fully documented Polish intrusion chain looks like, CERT.PL's energy sector report is instructive and, per SecurityWeek and Infosecurity Magazine, describes a genuinely novel path: compromise of an internet-exposed FortiGate VPN and firewall at a wind farm, pivot through a Teltonika cellular router on the same network, an SSH tunnel into a private Access Point Name network managed by a distribution system operator, repeated APN scanning until a WAGO PFC200 PLC at the CHP plant was found with its web interface exposed and protected only by default admin credentials, then SSH into the plant's OT network where three Siemens PLCs were located and switched to STOP mode with a password blocking recovery. CERT.PL assesses this as the first documented case of OT network access via a private APN, and warns the same vulnerable configuration is common in Poland and internationally. That is a separate incident from MyDr, with a separate actor and a separate motive, but the underlying pattern is identical: the weak link was a trusted third-party network path, not the target's own perimeter.
What Organizations Should Do
- Inventory your healthtech and SaaS data processors by data volume, not by contract value. The vendor holding PESEL-equivalent identifiers plus clinical notes for millions of patients is a higher-tier risk than a larger supplier holding invoices. Map which providers can enumerate your entire patient population in a single query.
- Force a credential and default-password audit across every appliance, PLC, router, and admin web interface reachable from any partner or private carrier network. The CERT.PL report shows a national-grid intrusion turning on a default admin credential on an exposed PLC web UI. Private APNs and vendor VPN tunnels are not trusted zones.
- Instrument for bulk read and bulk export, not just for intrusion. A 2 TB exfiltration is a detection opportunity measured in hours, and MyDr's exposure ran from at least 6 August to public disclosure on 11 August. Alert on anomalous query volume, unusual result-set sizes, and egress spikes from database and reporting tiers.
- Segment and tokenise national identifiers. PESEL, or your jurisdiction's equivalent, should not sit in plaintext alongside clinical records in a single queryable store. Separating identity keys from health content converts a catastrophic breach into a serious but survivable one.
- Write third-party breach notification into your incident plan now. All 12,000 MyDr customer facilities inherited controller-side GDPR obligations from an event they did not detect and cannot investigate. Pre-agree evidence access, forensic cooperation, and notification timelines in contract.
- Prepare patient-facing fraud guidance in advance. Poland's response leaned on citizens locking their PESEL. Have the equivalent instruction, the channel to deliver it, and the identity-protection provisioning ready before you need them, and expect a wave of phishing that spoofs your own breach notice.
Sources: Medical records of nearly 19M Poles leaked in major cyber breach | Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy F... | Russian-Linked Hackers Accessed Polish Power Plant OT Through APN -... | Poland hit by theft of 19 million patients’ data from medical platf... | Medical data breach exposes information of 19 million Poles - TRT W... | Cyberattack on MyDr exposes medical data of nearly 19 million Poles... | The MyDr data breach may affect 19 million Poles. The data came fro... | Polish Healthtech Platform MyDr Hit by Major Data Breach Affecting...