Poland's Digital Affairs Minister Krzysztof Gawkowski confirmed on 12 and 13 August 2026 that attackers stole personal and medical records belonging to close to 19 million people from MyDr, a private electronic medical records (EMR) provider used across the Polish healthcare system. Gawkowski called it "one of the largest incidents in Poland's history." Prime Minister Donald Tusk, speaking at a separate press conference on Thursday, said the attack used "very sophisticated techniques and methods" and that "the motivation appears to be purely criminal," most likely a ransom extortion attempt against the company. Figures for the victim count differ slightly by source: the attackers themselves claimed roughly 18.8 million people in their outreach to the Polish security news site Zaufana Trzecia Strona (as reported by Notes From Poland), while the Ministry of Digitalization and subsequent coverage from Anadolu Agency, TVP World and Pollar all put it at "nearly 19 million." Poland's total population is under 38 million, meaning the affected set plausibly approaches half the country.
What Happened
MyDr supplies electronic medical records software to Polish doctors, clinics and practices. Pollar reports the customer base at 12,000 healthcare facilities; TVP World describes the company more generally as "one of Poland's largest providers of electronic medical-record systems." Neither figure has been independently confirmed by a government filing in the sources reviewed here.
According to Pollar, prosecutor Piotr Antoni Skiba, spokesperson for the Warsaw district prosecutor's office overseeing the case, stated that the perpetrator gained unauthorized access to MyDr's servers no later than 6 August 2026 by breaking or circumventing IT security measures. The offense as charged carries a penalty of up to three years in prison.
The breach surfaced publicly through the attackers, not the victim. Notes From Poland reports that Zaufana Trzecia Strona was contacted on Saturday by the alleged perpetrators, who claimed access to the data of around 18.8 million people and supplied a screenshot from the compromised database showing the personal data of "one of the most important politicians in Poland." Zaufana Trzecia Strona published on Monday. MyDr then confirmed that it had "become the target of an external, deliberate criminal activity involving some of our data."
Accounts differ on the precise procedural dates. Pollar's timeline places the first ex officio investigative actions on 11 August but labels that day "Monday"; 10 August 2026 was the Monday, matching Notes From Poland's account of the Zaufana Trzecia Strona publication. The Ministry of Digitalization confirmed the attack publicly on Wednesday 12 August, with the CBZC (Central Bureau for Combating Cybercrime) formally launching its investigation the same day. Tusk and Gawkowski held press conferences on Thursday 13 August.
Gawkowski's position as of Thursday is that the stolen data has not surfaced: "The most important thing is that this data is not available in the public domain today. That means it is not for sale anywhere, nor is it part of any game." He said state security services are tracking the group and that there is currently no evidence of foreign involvement. Asked whether a ransom had been demanded, he said he knew the details but that the information was classified. His stated policy line: "The ministry and state services do not negotiate with hackers. We hunt criminals down; we do not strike deals with them."
What Was Taken
Per Pollar, the stolen database exceeds 2 TB and contains names, PESEL national identification numbers, phone numbers, email addresses, doctors' visit notes, and prescription information. Notes From Poland describes the holdings as patients' personal information plus medical details including diagnoses and prescriptions. TVP World's account, sourced to Gawkowski, describes online patient records including prescription and medication data. The 2 TB figure and the specific field list come from a single OTHER-tier source and should be treated as reported rather than confirmed.
Three properties make this set unusually dangerous:
- PESEL numbers. Poland's PESEL is a durable national identifier used in banking, credit and government service authentication. It cannot be rotated. Gawkowski explicitly urged citizens to "lock" their PESEL to prevent fraudulent credit applications.
- Clinical narrative. Visit notes and diagnoses are not just identity data. They are coercion material, and unlike a password they never expire.
- Population-scale linkage. A single record set combining PESEL, phone, email and health history for a large share of a national population is a ready-made enrichment source for every downstream fraud and social engineering campaign against Polish targets for years.
Gawkowski said Poland's Internal Security Agency (ABW) had directly contacted prominent public figures whose data was affected, which is consistent with the attackers' choice to lead their extortion play with a screenshot of a senior politician's record.
Why It Matters
This lands on a country already under sustained pressure. Two separate reporting threads in the current source set make that context concrete.
First, the OT side. BleepingComputer and Security Affairs both reported on 10 August that CERT Polska disclosed a second, previously unreported victim in the destructive December 2025 attacks on Poland's energy sector. On 29 December 2025, an attacker assessed as linked to the Russian Electrum threat group hit 30 wind and solar installations and a large combined heat-and-power plant, destroying equipment beyond repair, wiping Windows systems and corrupting OT devices. The newly disclosed second victim was a smaller CHP plant serving heat to roughly 50,000 residents, where the actor switched off programmable logic controllers and password-protected access to them, taking a steam turbine and the process-water treatment system offline. CERT Polska attributed the pivot to a private APN misconfiguration that "allowed arbitrary devices within the private APN network to communicate with one another," after an initial compromise of a FortiGate VPN/firewall at a wind farm and abuse of a Teltonika cellular router.
Second, the exposure surface. TechCrunch reported on 7 August, five days before the MyDr confirmation, that security researchers scanning the Polish web found courts, hospitals and airports at risk of compromise.
Gawkowski says there is no evidence of foreign involvement in the MyDr breach and Tusk frames it as pure criminal extortion. Both statements should be read as current assessments, not final ones. The defensive point stands regardless: the same national attack surface is being worked by both a destructive state-aligned actor and financially motivated crews, and the healthcare software supply chain turned out to be the softest target of the three.
The third-party angle is the reusable lesson. No hospital was breached. One vendor was, and roughly half a country's patient records went with it.
The Attack Technique
The initial access vector for MyDr has not been publicly disclosed. Gawkowski said only that the vulnerability exploited by the hackers has since been identified and patched. Tusk characterized the tradecraft as sophisticated. The prosecutor's framing, breaking or circumventing IT security measures to reach MyDr's servers, is a legal characterization rather than a technical one. No CVE, malware family, or named group has been attached to this incident by any source reviewed.
One source in this set requires an explicit caveat. SentinelOne's vulnerability database entry for CVE-2026-16334, published 23 July 2026, describes a SQL injection flaw in itsourcecode Hospital Management System 1.0, where the editid parameter of /prescriptionorder.php is concatenated into a query without parameterization, allowing an authenticated low-privilege remote attacker to read or modify patient and prescription records. A public exploit has been referenced in third-party vulnerability databases. There is no reported connection between CVE-2026-16334 and the MyDr breach. Different product, different vendor, no source links them. It is included here only as a live illustration of the class of flaw that puts prescription and patient tables at risk in healthcare software, and as a reminder that exposed instances of this specific product are being opportunistically targeted independent of anything happening in Poland.
Treat any claim you see attributing MyDr to a specific CVE right now as unsourced.
What Organizations Should Do
- Inventory your EMR and clinical software supply chain by data access, not by contract value. MyDr held records for a reported 12,000 facilities. Ask, for every vendor touching patient data, what the blast radius is if their production database walks out the door, and get that answer in writing before the incident, not during it.
- Audit healthcare web applications for injection flaws in exactly the places CVE-2026-16334 lives. Prescription, order and record-edit endpoints that take an ID parameter are the canonical pattern. Enforce parameterized queries, and if you run itsourcecode Hospital Management System 1.0 or similar low-cost EMR packages, get them off the public internet now given a public exploit is already circulating.
- Apply the CERT Polska APN lesson to any private mobile network you operate. The Polish energy incident escalated because devices inside a private APN could talk to each other freely. Default-deny east-west traffic within private APNs and cellular gateways, and treat cellular routers such as the Teltonika units named by CERT as in-scope OT assets with full patching and credential management.
- Harden and monitor internet-facing VPN and firewall appliances as tier-zero infrastructure. A FortiGate at a wind farm was the entry point for a campaign that destroyed equipment beyond repair. Enforce MFA, log authentication centrally, and alert on first-seen source geographies and anomalous session times.
- Build the "identifier cannot be rotated" playbook now. For PESEL, SSN or equivalent national IDs, pre-plan the customer-facing response: identity locking guidance, a verification portal, and scripted fraud-desk procedures. Poland is routing citizens through the state-run Bezpieczne Dane portal to check exposure; if you hold national IDs, know in advance what your equivalent is.
- Rehearse the disclosure scenario where the attacker goes to the press first. MyDr learned about its breach when journalists did. Decide in advance who speaks, how fast you confirm, and what you say about ransom demands. Poland's government chose a clear public no-negotiation line within 24 hours, which is a defensible posture only if you have prepared for it.
- Assume this data set will eventually circulate even though it has not yet. Gawkowski's "not in the public domain today" is a point-in-time statement with a heavy emphasis on "today." Polish-facing organizations should raise scrutiny on identity-proofing flows and expect highly convincing, medically-informed pretexting.
Sources: Medical records of nearly 19M Poles leaked in major cyber breach | CVE-2026-16334: Hospital Management System SQLi Flaw | Security researchers scanned the Polish web and found courts, hospi... | Hackers breached a small Polish energy plant via private APN last year | Hackers Cross From IT to OT Through a Private APN in Poland | Poles' stolen medical data 'not made public,' gov't says | Poland hit by theft of 19 million patients’ data from medical platf... | Cyberattack on MyDr exposes medical data of nearly 19 million Poles...