Poland's Ministry of Digitalisation confirmed on Wednesday 12 August that MyDr, one of the country's largest electronic medical documentation providers, was breached by unidentified attackers who exfiltrated patient data belonging to nearly 19 million people, roughly half the national population. Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski called it "unprecedented" and among the largest incidents in Poland's history; Prime Minister Donald Tusk said the techniques were "very sophisticated" and the motive "appears to be purely criminal," pointing to an attempted ransom extraction from the company. Figures for the victim count differ by source: Gawkowski and the ministry cite "nearly 19 million" and Gawkowski told reporters that "as confirmed by the company itself, 19 million records were stolen" (TRT World), while the attackers themselves claimed 18.8 million people to the Polish security outlet Zaufana Trzecia Strona (Notes from Poland, Cybernews). MyDr's own breach notice is more cautious still, saying it "cannot confirm the amount and type of data that was exposed" pending forensics.
What Happened
According to Piotr Antoni Skiba, spokesperson for the Warsaw district prosecutor's office overseeing the case, the perpetrator obtained unauthorised access to MyDr's servers no later than 6 August 2026 by breaking or circumventing IT security measures, an offence carrying up to three years' imprisonment under Polish law (Pollar). The attackers surfaced publicly not through the victim but through the press: Zaufana Trzecia Strona reported it was contacted on Saturday 8 August by the alleged perpetrators, and published first on Monday 10 August. Cybernews, citing Wyborcza.pl, reports the attackers approached at least one further outlet, apparently after failing to reach MyDr representatives directly.
Poland's Central Bureau for Combating Cybercrime (CBZC) formally opened an investigation on 12 August, the same day the digitisation ministry confirmed the incident; Tusk and Gawkowski held press conferences on 13 August. Pollar's published timeline labels the first ex officio investigative actions as 11 August while also calling that day "Monday," a one day inconsistency against the other reporting, which places Monday at 10 August.
Two claims about the data are worth holding apart. MyDr states the affected information "likely dates to 2024 and earlier" and "doesn't include all MyDr customers and patients" (Cybernews). The government's near 19 million figure and the attackers' 18.8 million claim both imply near total coverage of the platform's population. Those accounts are not reconcilable from public information yet, and the honest reading is that scope is still contested pending forensic confirmation.
What Was Taken
The stolen dataset is described as exceeding 2 TB (Pollar) or over 2.5 TB (Cybernews, relaying the attackers' own claim). Reported field types across sources include full names, PESEL national identification numbers, phone numbers, email addresses, doctors' visit notes, diagnoses, and prescription and medication histories. MyDr supplies electronic medical record software to thousands of clinics and practices; Pollar puts the deployed base at 12,000 healthcare facilities.
The attackers demonstrated access by handing journalists a database screenshot containing the record of "one of the most important politicians in Poland," including that person's PESEL number, two phone numbers, and a list of 25 prescribed medications (Notes from Poland, Cybernews). Poland's Internal Security Agency (ABW) subsequently contacted prominent public figures whose data was affected (TVP World).
As of Gawkowski's 13 August remarks, the data had not appeared in the public domain: "it is not for sale anywhere, nor is it part of any game." That is a snapshot, not an all clear. Extortion sets typically withhold publication precisely while negotiation leverage still exists.
Why It Matters
A PESEL number plus a verified name, phone number and prescription list is a near complete identity fraud kit, and unlike a password it cannot be rotated. Prescription histories additionally expose psychiatric care, HIV treatment, fertility treatment and oncology status, which converts a fraud problem into a coercion problem for the subset of victims who hold sensitive public or security cleared roles. ABW's outreach to public figures indicates the Polish state reached the same conclusion.
Gawkowski has repeatedly stated there is currently no indication the data was taken by another state, and Tusk's assessment points to ransom driven crime. Asked directly whether a ransom was demanded, Gawkowski said he knew the details but that the information is classified. Government messaging on response has been unambiguous: "The ministry and state services do not negotiate with hackers. We hunt criminals down; we do not strike deals with them," and separately, "Nobody will give in to any blackmail."
The strategic lesson is concentration risk. One software vendor sitting under 12,000 clinics is a single point of failure for a national patient population, and the blast radius of its compromise is set by aggregation, not by the security of any individual clinic.
The Attack Technique
The initial access vector has not been published. Gawkowski said the vulnerability exploited by the attackers has been identified and patched, but neither the ministry nor MyDr has described the flaw, the software affected, or whether exploitation was pre authenticated. The prosecutor's language, breaking or circumventing IT security measures, is a legal characterisation rather than a technical one. No threat group has been named, and no group has been publicly linked by any source tier here.
What can be said with confidence: dwell time began on or before 6 August, exfiltration was large enough to move multiple terabytes without triggering a stop, and the operators possessed enough of the dataset to selectively pull and present a named individual's full record on demand. Treat any specific exploit chain circulating elsewhere as unconfirmed until CERT Polska or MyDr publishes technical detail.
The Wider Polish Threat Picture
This lands in an already active period for Polish infrastructure. On 10 August, BleepingComputer reported that CERT Polska disclosed a second victim in the December 2025 destructive attacks on Poland's energy sector: a small combined heat and power plant serving around 50,000 residents, where an attacker attributed to the Russia linked Electrum group switched off PLCs and password protected them, taking down a steam turbine and the plant's process water treatment system. Investigators traced the access path from a compromised FortiGate VPN or firewall at a wind farm through a Teltonika cellular router into a private APN, where a misconfiguration allowed arbitrary devices on the APN to talk to each other. Separately, TechCrunch reported on 7 August that researchers scanning Polish internet facing infrastructure found courts, hospitals and airports exposed to attack.
Those are distinct incidents with distinct actors, and nothing in the sourcing connects them to MyDr. The relevance is environmental: Polish critical services are under sustained pressure from both state aligned destructive operators and financially motivated crews, and defenders in the region should plan for both threat models at once.
What Organizations Should Do
- Inventory your aggregation points. Identify every vendor holding a full copy of your patient, customer or citizen population, and treat each one as an independent tier one asset with its own attestation, patch SLA and breach clock. Vendor headcount is a poor proxy for vendor blast radius.
- Instrument for bulk egress, not just intrusion. Multiple terabytes leaving a records platform should trip a hard alert. Baseline normal outbound volume per application, alert on standard deviation breaches, and rate limit or require approval for bulk exports from production databases.
- Assume media first disclosure. The attackers here reached journalists before the victim was reachable. Publish a monitored security contact and a security.txt, and rehearse an intake path for third party breach notification that does not depend on a sales inbox.
- Cut external exposure on edge devices. The parallel CERT Polska findings implicate an internet facing FortiGate and a permissive private APN. Patch VPN and firewall appliances on an emergency cycle, enforce segmentation inside APNs and cellular management networks, and deny device to device traffic by default.
- Minimise and age off sensitive fields. MyDr indicates much of the affected data predates 2025. Data that is retained past its clinical or legal purpose is pure liability; enforce retention schedules and consider tokenising national identifiers so a database dump is not directly monetisable.
- Give affected individuals real remedies. Poland's response is a usable template: point citizens to identity monitoring services and encourage locking the national ID number against credit and contract fraud. Polish residents can check exposure via the government run Bezpieczne Dane portal and apply a PESEL lock.
Sources: Medical data breach exposes information of 19 million Poles - TRT W... | Security researchers scanned the Polish web and found courts, hospi... | Hackers breached a small Polish energy plant via private APN last year | Poles' stolen medical data 'not made public,' gov't says | Poland hit by theft of 19 million patients' data from medical ... | European nation rocked by major hacker attack: “largest data leak i... | Cyberattack on MyDr exposes medical data of nearly 19 million Poles... | Polish Healthtech Platform MyDr Hit by Major Data Breach Affecting...