Loading story…
Polish healthcare software provider MyDr said it is investigating a serious security incident after alleged attackers claimed access to patient data from numerous clinics using its systems. According to reports, the threat actors said they obtained 18,814,422 unique PESEL numbers from medical systems, raising the prospect of one of the country’s largest healthcare-related data exposures. Journalist Adam Haertle reportedly received the claim directly, attempted to validate it, and alerted the relevant authorities.
Polish media and officials subsequently described the incident as a major breach affecting the medical data of roughly 19 million people. MyDr is one of Poland’s largest electronic medical records providers, serving thousands of healthcare facilities and supporting millions of visits and prescriptions each month, which suggests the compromise could have broad downstream impact across clinics and patients if the attackers’ claims are confirmed.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
MyDr said it is investigating a serious security incident affecting its network after alleged threat actors claimed access to patient data from numerous Polish clinics. The claimed exposure involves sensitive healthcare data and national identification numbers tied to MyDr-connected medical systems.
Adam Haertle reported that on a Saturday he was contacted by someone claiming to hold data on more than 18 million Polish men and women, including 18,814,422 unique PESEL numbers allegedly extracted from medical systems. He contacted the claimant directly and notified the appropriate authorities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
pap.pl
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Polish authorities are investigating a cyberattack on healthcare software provider **MyDr** that may have exposed historical data tied to nearly **19 million people** and more than **12,000 medical facilities**. Prime Minister Donald Tusk said the breach was intended to extort a ransom, while officials stressed there is no indication that Poland’s public healthcare systems or the national **P1** electronic health platform were compromised. MyDr said it identified and removed the source of the incident, introduced additional security measures, and had found no evidence that the stolen data had been publicly released. As a precaution, Poland’s **e-Health Center** is replacing digital certificates used by medical systems to connect to the P1 platform, even though authorities said there is no evidence the certificates were stolen or abused. Regulators and security agencies are continuing to investigate the scope of the breach and identify those responsible, as the incident raises concern over the exposure of sensitive healthcare records and operational data across the country’s medical sector.
Aug 17, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Medical Computer Business Services (MCBS), a Georgia-based medical billing and practice-management firm, disclosed that a September 2025 network intrusion exposed the personal, insurance, and medical information of **1,261,464 individuals**. The company said unauthorized actors accessed its systems between **September 22 and September 26, 2025**, and that the compromised data may include names, addresses, Social Security numbers, dates of birth, insurance identifiers, medical histories, diagnoses, and treatment details. MCBS reported that the affected records were tied to data it managed for **seven healthcare organizations**. The incident has been linked to the **PEAR ransomware** group, which claimed responsibility shortly after the intrusion and alleged it stole more than **3 TB** of data, including patient `PII`/`PHI`, financial records, HR documents, payment information, and emails. MCBS said its investigation concluded on **May 28, 2026**, while U.S. Department of Health and Human Services breach-tracker data lists the event among major healthcare breaches, underscoring the scale of the exposure and the risk to patients and partner providers.
Jul 30, 2026