Loading story…
Polish authorities are investigating a cyberattack on healthcare software provider MyDr that may have exposed historical data tied to nearly 19 million people and more than 12,000 medical facilities. Prime Minister Donald Tusk said the breach was intended to extort a ransom, while officials stressed there is no indication that Poland’s public healthcare systems or the national P1 electronic health platform were compromised. MyDr said it identified and removed the source of the incident, introduced additional security measures, and had found no evidence that the stolen data had been publicly released.
As a precaution, Poland’s e-Health Center is replacing digital certificates used by medical systems to connect to the P1 platform, even though authorities said there is no evidence the certificates were stolen or abused. Regulators and security agencies are continuing to investigate the scope of the breach and identify those responsible, as the incident raises concern over the exposure of sensitive healthcare records and operational data across the country’s medical sector.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
Polish authorities said hackers obtained unauthorized access to historical data held in MyDr systems, with the exposed data spanning through April 2024. The incident may have affected nearly 19 million people and more than 12,000 medical facilities, though officials said not all customers or patients were necessarily impacted.
Poland's e-Health Center started replacing digital certificates used by medical systems to connect to the national P1 electronic health platform. Officials said there was no evidence the certificates were stolen or misused, and that the replacement should not disrupt services such as e-prescriptions and referrals.
Polish authorities began investigating the cyberattack against MyDr, while the Personal Data Protection Office said it planned to inspect the company. Security agencies are also working to identify those responsible, and officials said MyDr could face legal consequences if procedural failures are found.
According to the referenced Polish Radio report, Poland's prime minister said the major Polish data breach was intended to extort a ransom. This adds motive information to the MyDr incident narrative.
Polish cybersecurity publication Zaufana Trzecia Strona reported that people claiming responsibility for the breach contacted the outlet and provided alleged evidence, including a screenshot containing information belonging to a prominent Polish politician. The reported samples have not been independently verified.
After identifying the incident, MyDr said it removed the cause and introduced additional security measures. The company also said its systems remained operational and safe for doctors and patients.
MyDr previously disclosed that parts of its systems were affected by what it described as external, intentional criminal activity. The company did not disclose the vulnerability or initial access method used in the attack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcepolskieradio.pl
Open sourcepro.mydr.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Polish healthcare software provider **MyDr** said it is investigating a serious security incident after alleged attackers claimed access to patient data from numerous clinics using its systems. According to reports, the threat actors said they obtained **18,814,422 unique PESEL numbers** from medical systems, raising the prospect of one of the country’s largest healthcare-related data exposures. Journalist Adam Haertle reportedly received the claim directly, attempted to validate it, and alerted the relevant authorities. Polish media and officials subsequently described the incident as a major breach affecting the medical data of roughly **19 million people**. MyDr is one of Poland’s largest electronic medical records providers, serving thousands of healthcare facilities and supporting millions of visits and prescriptions each month, which suggests the compromise could have broad downstream impact across clinics and patients if the attackers’ claims are confirmed.
Aug 13, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Healthdaq, a Dublin-based recruitment platform used by Northern Ireland health trusts and other public health bodies, disclosed unauthorized access to its systems after attackers linked to the **XP95** extortion group claimed to have stolen nearly half a million files. Reported exposed data includes names, contact details, CVs, qualifications, passport copies, other government-issued identification, criminal background checks, vaccine records, forms, and in some cases health information. Healthdaq said it detected the breach on 30 March, contained the incident, and notified regulators and law enforcement, including the Garda National Cyber Crime Bureau, while the UK Information Commissioner's Office said it is assessing the company’s report. The incident prompted heightened alerts across Northern Ireland health trusts because of the volume and sensitivity of the compromised records and the risk of identity theft, fraud, and misuse of personal information. Reporting indicates Healthdaq received a ransom demand, and threat intelligence describes XP95 as a newly observed actor using a **pure data theft and extortion** model rather than file-encrypting ransomware; its first publicly identified victim was Eholo Health, a Spanish mental health SaaS provider serving psychologists in Spain and Andorra. The breach also underscored broader pressure on healthcare technology suppliers after a separate attack on Dutch EPD vendor ChipSoft disrupted hospital services and triggered parliamentary scrutiny over sector dependence on a small number of critical vendors.
Jun 29, 2026