Millions of Poles affected. Following a mew medical data leak, the Personal Data Protection Office announces an inspection
Media outlets are reporting a new data leak that may have exposed the medical data of as many as five million Poles. The Central Bureau for Combating Cybercrime is investigating the case, and the President of the Personal Data Protection Office has already announced an inspection of the company responsible for the Medyc software.
Threats and consequences
The incident resulted from an attack on the Medyc application. Krzysztof Gawkowski, Deputy Prime Minister and Minister of Digital Affairs, has already commented on the matter on his X profile:
“Statement regarding a potential cybersecurity incident involving Medyc software. As part of a broader investigation, the Central Bureau for Combating Cybercrime is conducting activities related to a cybersecurity incident involving, among other things, software developed by Qbusoft Sp. z o.o., the company behind Medyc. In response to the current cybersecurity threat and attacks targeting healthcare providers and medical software suppliers, the CeZ Computer Security Incident Response Team (CSIRT CeZ) and the Ministry of Health have developed security recommendations for healthcare software providers. These recommendations were sent to providers for implementation on September 16, 2026. To date, Qbusoft Sp. z o.o. has not reported a cybersecurity incident to CERT Polska or CSIRT CeZ. If any security procedures have been violated by a private company, severe consequences will follow.”
Personal Data Protection Office inspection announced
The President of the Personal Data Protection Office is also investigating the matter. Mirosław Wróblewski has announced that he will inspect the company Qbusoft.
Similar action was taken by the President of the Personal Data Protection Office in August this year, following reports of a data leak involving MyDr. At the time, it was announced that “the technical and organizational measures implemented, including the risk assessment, will be subject to an inspection by the Personal Data Protection Office at the company where the leak of patients’ health data occurred.”
The MyDr data leak affects 19 million Poles. By September 17, the President of the Personal Data Protection Office had received more than 50 complaints and notifications relating to the incident. In addition, more than 2,000 notifications had been submitted by data controllers.
On Wednesday, September 16, President Mirosław Wróblewski decided that broader inspections of the processing of health-related data were necessary. This decision was made not only in connection with the cyberattack involving MyDr data, but also in response to numerous other cases of data breaches.
He therefore decided to conduct additional inspections through the end of 2026.